Update all files to use {% data %} (#15253)
* Add back changes from prior to purge * Manually fix some invalid Liquid * Updoot render-content * Improve test messages to show correct output * Run el scripto * Pass the remaining test
This commit is contained in:
Jason Etcovitch
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: About code scanning
|
||||
intro: 'You can use {{ site.data.variables.product.prodname_code_scanning }} to find security vulnerabilities and errors in the code for your project on {{ site.data.variables.product.prodname_dotcom }}.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: 'You can use {% data variables.product.prodname_code_scanning %} to find security vulnerabilities and errors in the code for your project on {% data variables.product.prodname_dotcom %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/about-automated-code-scanning
|
||||
versions:
|
||||
@@ -9,53 +9,53 @@ versions:
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### About {{ site.data.variables.product.prodname_code_scanning }}
|
||||
### About {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
{{ site.data.reusables.code-scanning.about-code-scanning }}
|
||||
{% data reusables.code-scanning.about-code-scanning %}
|
||||
|
||||
You can use {{ site.data.variables.product.prodname_code_scanning }} to find, triage, and prioritize fixes for existing problems in your code. {{ site.data.variables.product.prodname_code_scanning_capc }} also prevents developers from introducing new problems. You can schedule scans for specific days and times, or trigger scans when a specific event occurs in the repository, such as a push.
|
||||
You can use {% data variables.product.prodname_code_scanning %} to find, triage, and prioritize fixes for existing problems in your code. {% data variables.product.prodname_code_scanning_capc %} also prevents developers from introducing new problems. You can schedule scans for specific days and times, or trigger scans when a specific event occurs in the repository, such as a push.
|
||||
|
||||
If {{ site.data.variables.product.prodname_code_scanning }} finds a potential vulnerability or error in your code, {{ site.data.variables.product.prodname_dotcom }} displays an alert in the repository. After you fix the code that triggered the alert, {{ site.data.variables.product.prodname_dotcom }} closes the alert. For more information, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
If {% data variables.product.prodname_code_scanning %} finds a potential vulnerability or error in your code, {% data variables.product.prodname_dotcom %} displays an alert in the repository. After you fix the code that triggered the alert, {% data variables.product.prodname_dotcom %} closes the alert. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
To monitor results from {{ site.data.variables.product.prodname_code_scanning }} across your repositories or your organization, you can use the {{ site.data.variables.product.prodname_code_scanning }} API.
|
||||
For more information about API endpoints, see "[{{ site.data.variables.product.prodname_code_scanning_capc }}](/v3/code-scanning)."
|
||||
To monitor results from {% data variables.product.prodname_code_scanning %} across your repositories or your organization, you can use the {% data variables.product.prodname_code_scanning %} API.
|
||||
For more information about API endpoints, see "[{% data variables.product.prodname_code_scanning_capc %}](/v3/code-scanning)."
|
||||
|
||||
To get started with {{ site.data.variables.product.prodname_code_scanning }}, see "[Enabling {{ site.data.variables.product.prodname_code_scanning }} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
To get started with {% data variables.product.prodname_code_scanning %}, see "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
|
||||
### About {{ site.data.variables.product.prodname_codeql }}
|
||||
### About {% data variables.product.prodname_codeql %}
|
||||
|
||||
You can use {{ site.data.variables.product.prodname_code_scanning }} with {{ site.data.variables.product.prodname_codeql }}, a semantic code analysis engine. {{ site.data.variables.product.prodname_codeql }} treats code as data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers.
|
||||
You can use {% data variables.product.prodname_code_scanning %} with {% data variables.product.prodname_codeql %}, a semantic code analysis engine. {% data variables.product.prodname_codeql %} treats code as data, allowing you to find potential vulnerabilities in your code with greater confidence than traditional static analyzers.
|
||||
|
||||
{{ site.data.variables.product.prodname_ql }} is the query language that powers {{ site.data.variables.product.prodname_codeql }}. {{ site.data.variables.product.prodname_ql }} is an object-oriented logic programming language. {{ site.data.variables.product.company_short }}, language experts, and security researchers create the queries used for {{ site.data.variables.product.prodname_code_scanning }}, and the queries are open source. The community maintains and updates the queries to improve analysis and reduce false positives. For more information, see [{{ site.data.variables.product.prodname_codeql }}](https://securitylab.github.com/tools/codeql) on the GitHub Security Lab website.
|
||||
{% data variables.product.prodname_ql %} is the query language that powers {% data variables.product.prodname_codeql %}. {% data variables.product.prodname_ql %} is an object-oriented logic programming language. {% data variables.product.company_short %}, language experts, and security researchers create the queries used for {% data variables.product.prodname_code_scanning %}, and the queries are open source. The community maintains and updates the queries to improve analysis and reduce false positives. For more information, see [{% data variables.product.prodname_codeql %}](https://securitylab.github.com/tools/codeql) on the GitHub Security Lab website.
|
||||
|
||||
{{ site.data.variables.product.prodname_code_scanning_capc }} with {{ site.data.variables.product.prodname_codeql }} supports both compiled and interpreted languages, and can find vulnerabilities and errors in code that's written in the supported languages.
|
||||
{% data variables.product.prodname_code_scanning_capc %} with {% data variables.product.prodname_codeql %} supports both compiled and interpreted languages, and can find vulnerabilities and errors in code that's written in the supported languages.
|
||||
|
||||
{{ site.data.reusables.code-scanning.supported-languages }}
|
||||
{% data reusables.code-scanning.supported-languages %}
|
||||
|
||||
You can view and contribute to the queries for {{ site.data.variables.product.prodname_code_scanning }} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{{ site.data.variables.product.prodname_codeql }} queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) in the {{ site.data.variables.product.prodname_codeql }} documentation.
|
||||
You can view and contribute to the queries for {% data variables.product.prodname_code_scanning %} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %} queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) in the {% data variables.product.prodname_codeql %} documentation.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
||||
### About billing for {{ site.data.variables.product.prodname_code_scanning }}
|
||||
### About billing for {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
{{ site.data.variables.product.prodname_code_scanning_capc }} uses {{ site.data.variables.product.prodname_actions }}, and each run of a {{ site.data.variables.product.prodname_code_scanning }} workflow consumes minutes for {{ site.data.variables.product.prodname_actions }}. For more information, see "[About billing for {{ site.data.variables.product.prodname_actions }}](/github/setting-up-and-managing-billing-and-payments-on-github/about-billing-for-github-actions)."
|
||||
{% data variables.product.prodname_code_scanning_capc %} uses {% data variables.product.prodname_actions %}, and each run of a {% data variables.product.prodname_code_scanning %} workflow consumes minutes for {% data variables.product.prodname_actions %}. For more information, see "[About billing for {% data variables.product.prodname_actions %}](/github/setting-up-and-managing-billing-and-payments-on-github/about-billing-for-github-actions)."
|
||||
|
||||
{% endif %}
|
||||
|
||||
### About third-party code scanning tools
|
||||
|
||||
{{ site.data.reusables.code-scanning.you-can-upload-third-party-analysis }}
|
||||
{% data reusables.code-scanning.you-can-upload-third-party-analysis %}
|
||||
|
||||
{{ site.data.reusables.code-scanning.interoperable-with-tools-that-output-sarif }}
|
||||
{% data reusables.code-scanning.interoperable-with-tools-that-output-sarif %}
|
||||
|
||||
{{ site.data.reusables.code-scanning.get-started-uploading-third-party-data }}
|
||||
{% data reusables.code-scanning.get-started-uploading-third-party-data %}
|
||||
|
||||
### Further reading
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
- "[About securing your repository](/github/administering-a-repository/about-securing-your-repository)"{% endif %}
|
||||
- [{{ site.data.variables.product.prodname_security }}](https://securitylab.github.com/)
|
||||
- [{% data variables.product.prodname_security %}](https://securitylab.github.com/)
|
||||
- [OASIS Static Analysis Results Interchange Format (SARIF) TC](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif) on the OASIS Committee website
|
||||
|
||||
@@ -1,21 +1,21 @@
|
||||
---
|
||||
title: About integration with code scanning
|
||||
shortTitle: About integration
|
||||
intro: 'You can perform {{ site.data.variables.product.prodname_code_scanning }} externally and then display the results in {{ site.data.variables.product.prodname_dotcom }}.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: 'You can perform {% data variables.product.prodname_code_scanning %} externally and then display the results in {% data variables.product.prodname_dotcom %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
As an alternative to running {{ site.data.variables.product.prodname_code_scanning }} within {{ site.data.variables.product.prodname_dotcom }}, you can perform analysis elsewhere and then upload the results. Alerts for {{ site.data.variables.product.prodname_code_scanning }} that you run externally are displayed in the same way as those for {{ site.data.variables.product.prodname_code_scanning }} that you run within {{ site.data.variables.product.prodname_dotcom }}. For more information, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
As an alternative to running {% data variables.product.prodname_code_scanning %} within {% data variables.product.prodname_dotcom %}, you can perform analysis elsewhere and then upload the results. Alerts for {% data variables.product.prodname_code_scanning %} that you run externally are displayed in the same way as those for {% data variables.product.prodname_code_scanning %} that you run within {% data variables.product.prodname_dotcom %}. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
You can use your continuous integration or continuous delivery/deployment (CI/CD) system to run {{ site.data.variables.product.prodname_dotcom }}'s {{ site.data.variables.product.prodname_codeql }} analysis and upload the results to {{ site.data.variables.product.prodname_dotcom }}. This is an alternative to using {{ site.data.variables.product.prodname_actions }} to run {{ site.data.variables.product.prodname_codeql }} analysis. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
You can use your continuous integration or continuous delivery/deployment (CI/CD) system to run {% data variables.product.prodname_dotcom %}'s {% data variables.product.prodname_codeql %} analysis and upload the results to {% data variables.product.prodname_dotcom %}. This is an alternative to using {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_codeql %} analysis. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
|
||||
If you use a third-party static analysis tool that can produce results as Static Analysis Results Interchange Format (SARIF) 2.1.0 data, you can upload this to {{ site.data.variables.product.prodname_dotcom }}. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)."
|
||||
If you use a third-party static analysis tool that can produce results as Static Analysis Results Interchange Format (SARIF) 2.1.0 data, you can upload this to {% data variables.product.prodname_dotcom %}. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)."
|
||||
|
||||
### Further reading
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Automatically scanning your code for vulnerabilities and errors
|
||||
shortTitle: Scanning automatically
|
||||
intro: 'You can find vulnerabilities and errors in your project''s code on {{ site.data.variables.product.prodname_dotcom }}, as well as view, triage, understand, and resolve the related {{ site.data.variables.product.prodname_code_scanning }} alerts.'
|
||||
intro: 'You can find vulnerabilities and errors in your project''s code on {% data variables.product.prodname_dotcom %}, as well as view, triage, understand, and resolve the related {% data variables.product.prodname_code_scanning %} alerts.'
|
||||
mapTopic: true
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
|
||||
@@ -1,39 +1,39 @@
|
||||
---
|
||||
title: Configuring code scanning in your CI system
|
||||
shortTitle: Configuring in your CI
|
||||
intro: 'You can configure how the {{ site.data.variables.product.prodname_codeql_runner }} scans the code in your project and uploads the results to {{ site.data.variables.product.prodname_dotcom }}.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: 'You can configure how the {% data variables.product.prodname_codeql_runner %} scans the code in your project and uploads the results to {% data variables.product.prodname_dotcom %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### About {{ site.data.variables.product.prodname_code_scanning }} configuration in your CI system
|
||||
### About {% data variables.product.prodname_code_scanning %} configuration in your CI system
|
||||
|
||||
To integrate {{ site.data.variables.product.prodname_code_scanning }} into your CI system, you can use the {{ site.data.variables.product.prodname_codeql_runner }}. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
To integrate {% data variables.product.prodname_code_scanning %} into your CI system, you can use the {% data variables.product.prodname_codeql_runner %}. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
|
||||
In general, you invoke the {{ site.data.variables.product.prodname_codeql_runner }} as follows.
|
||||
In general, you invoke the {% data variables.product.prodname_codeql_runner %} as follows.
|
||||
|
||||
```
|
||||
$ /path/to-runner/codeql-runner-OS <COMMAND> <FLAGS>
|
||||
```
|
||||
|
||||
`/path/to-runner/` depends on where you've downloaded the {{ site.data.variables.product.prodname_codeql_runner }} on your CI system. `codeql-runner-OS` depends on the operating system you use.
|
||||
There are three versions of the {{ site.data.variables.product.prodname_codeql_runner }}, `codeql-runner-linux`, `codeql-runner-macos`, and `codeql-runner-win`, for Linux, macOS, and Windows systems respectively.
|
||||
`/path/to-runner/` depends on where you've downloaded the {% data variables.product.prodname_codeql_runner %} on your CI system. `codeql-runner-OS` depends on the operating system you use.
|
||||
There are three versions of the {% data variables.product.prodname_codeql_runner %}, `codeql-runner-linux`, `codeql-runner-macos`, and `codeql-runner-win`, for Linux, macOS, and Windows systems respectively.
|
||||
|
||||
To customize the way the {{ site.data.variables.product.prodname_codeql_runner }} scans your code, you can use flags, such as `--languages` and `--queries`, or you can specify custom settings in a separate configuration file.
|
||||
To customize the way the {% data variables.product.prodname_codeql_runner %} scans your code, you can use flags, such as `--languages` and `--queries`, or you can specify custom settings in a separate configuration file.
|
||||
|
||||
### Overriding automatic language detection
|
||||
|
||||
The {{ site.data.variables.product.prodname_codeql_runner }} automatically detects and scans code written in the supported languages.
|
||||
The {% data variables.product.prodname_codeql_runner %} automatically detects and scans code written in the supported languages.
|
||||
|
||||
{{ site.data.reusables.code-scanning.supported-languages }}
|
||||
{% data reusables.code-scanning.supported-languages %}
|
||||
|
||||
{{ site.data.reusables.code-scanning.specify-language-to-analyze }}
|
||||
{% data reusables.code-scanning.specify-language-to-analyze %}
|
||||
|
||||
To override automatic language detection, run the `init` command with the `--languages` flag, followed by a comma-separated list of language keywords. The keywords for the supported languages are `cpp`, `csharp`, `go`, `java`, `javascript`, and `python`.
|
||||
|
||||
@@ -43,17 +43,17 @@ $ /path/to-runner/codeql-runner-linux init --languages cpp,java
|
||||
|
||||
### Running additional queries
|
||||
|
||||
{{ site.data.reusables.code-scanning.run-additional-queries }}
|
||||
{% data reusables.code-scanning.run-additional-queries %}
|
||||
|
||||
{{ site.data.reusables.code-scanning.codeql-query-suites }}
|
||||
{% data reusables.code-scanning.codeql-query-suites %}
|
||||
|
||||
To add one or more queries, pass a comma-separated list of paths to the `--queries` flag of the `init` command. You can also specify additional queries in a configuration file.
|
||||
|
||||
If you also are using a configuration file for custom settings, and you are also specifying additional queries with the `--queries` flag, the {{ site.data.variables.product.prodname_codeql_runner }} uses the additional queries specified with the <nobr>`--queries`</nobr> flag instead of any in the configuration file.
|
||||
If you also are using a configuration file for custom settings, and you are also specifying additional queries with the `--queries` flag, the {% data variables.product.prodname_codeql_runner %} uses the additional queries specified with the <nobr>`--queries`</nobr> flag instead of any in the configuration file.
|
||||
If you want to run the combined set of additional queries specified with the flag and in the configuration file, prefix the value passed to <nobr>`--queries`</nobr> with the `+` symbol.
|
||||
For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)."
|
||||
|
||||
In the following example, the `+` symbol ensures that the {{ site.data.variables.product.prodname_codeql_runner }} uses the additional queries together with any queries specified in the referenced configuration file.
|
||||
In the following example, the `+` symbol ensures that the {% data variables.product.prodname_codeql_runner %} uses the additional queries together with any queries specified in the referenced configuration file.
|
||||
|
||||
```
|
||||
$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml
|
||||
@@ -62,9 +62,9 @@ $ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-c
|
||||
|
||||
### Using a custom configuration file
|
||||
|
||||
Instead of passing additional information to the {{ site.data.variables.product.prodname_codeql_runner }} commands, you can specify custom settings in a separate configuration file.
|
||||
Instead of passing additional information to the {% data variables.product.prodname_codeql_runner %} commands, you can specify custom settings in a separate configuration file.
|
||||
|
||||
The configuration file is a YAML file. It uses syntax similar to the workflow syntax for {{ site.data.variables.product.prodname_actions }}, as illustrated in the examples below. For more information, see "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions)."
|
||||
The configuration file is a YAML file. It uses syntax similar to the workflow syntax for {% data variables.product.prodname_actions %}, as illustrated in the examples below. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions)."
|
||||
|
||||
Use the `--config-file` flag of the `init` command to specify the configuration file. The value of <nobr>`--config-file`</nobr> is the path to the configuration file that you want to use. This example loads the configuration file _.github/codeql/codeql-config.yml_.
|
||||
|
||||
@@ -74,13 +74,13 @@ $ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-c
|
||||
|
||||
#### Example configuration files
|
||||
|
||||
{{ site.data.reusables.code-scanning.example-configuration-files }}
|
||||
{% data reusables.code-scanning.example-configuration-files %}
|
||||
|
||||
### Configuring {{ site.data.variables.product.prodname_code_scanning }} for compiled languages
|
||||
### Configuring {% data variables.product.prodname_code_scanning %} for compiled languages
|
||||
|
||||
For the compiled languages C/C++, C#, and Java, {{ site.data.variables.product.prodname_codeql }} builds the code before analyzing it. In contrast to the other compiled languages, {{ site.data.variables.product.prodname_codeql }} analyzes Go without building the code.
|
||||
For the compiled languages C/C++, C#, and Java, {% data variables.product.prodname_codeql %} builds the code before analyzing it. In contrast to the other compiled languages, {% data variables.product.prodname_codeql %} analyzes Go without building the code.
|
||||
|
||||
For many common build systems, the {{ site.data.variables.product.prodname_codeql_runner }} can build the code automatically. To attempt to build the code automatically, run `autobuild` between the `init` and `analyze` steps. Note that if your repository requires a specific version of a build tool, you may need to install the build tool manually first.
|
||||
For many common build systems, the {% data variables.product.prodname_codeql_runner %} can build the code automatically. To attempt to build the code automatically, run `autobuild` between the `init` and `analyze` steps. Note that if your repository requires a specific version of a build tool, you may need to install the build tool manually first.
|
||||
|
||||
The `autobuild` process only ever attempts to build _one_ compiled language for a repository. The language automatically selected for analysis is the language with the most files. If you want to choose a language explicitly, use the `--language` flag of the `autobuild` command.
|
||||
|
||||
@@ -90,59 +90,59 @@ $ /path/to-runner/codeql-runner-linux autobuild --language csharp
|
||||
|
||||
If the `autobuild` command can't build your code, you can run the build steps yourself, between the `init` and `analyze` steps. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system#compiled-language-example)."
|
||||
|
||||
### Uploading {{ site.data.variables.product.prodname_code_scanning }} data to {{ site.data.variables.product.prodname_dotcom }}
|
||||
### Uploading {% data variables.product.prodname_code_scanning %} data to {% data variables.product.prodname_dotcom %}
|
||||
|
||||
By default, the {{ site.data.variables.product.prodname_codeql_runner }} uploads results from {{ site.data.variables.product.prodname_code_scanning }} when you run the `analyze` command. You can also upload SARIF files separately, by using the `upload` command.
|
||||
By default, the {% data variables.product.prodname_codeql_runner %} uploads results from {% data variables.product.prodname_code_scanning %} when you run the `analyze` command. You can also upload SARIF files separately, by using the `upload` command.
|
||||
|
||||
Once you've uploaded the data, {{ site.data.variables.product.prodname_dotcom }} displays the alerts in your repository. For more information, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository#viewing-an-alert)."
|
||||
Once you've uploaded the data, {% data variables.product.prodname_dotcom %} displays the alerts in your repository. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository#viewing-an-alert)."
|
||||
|
||||
### {{ site.data.variables.product.prodname_codeql_runner }} command reference
|
||||
### {% data variables.product.prodname_codeql_runner %} command reference
|
||||
|
||||
The {{ site.data.variables.product.prodname_codeql_runner }} supports the following commands and flags.
|
||||
The {% data variables.product.prodname_codeql_runner %} supports the following commands and flags.
|
||||
|
||||
#### `init`
|
||||
|
||||
Initializes the {{ site.data.variables.product.prodname_codeql_runner }} and creates a {{ site.data.variables.product.prodname_codeql }} database for each language to be analyzed.
|
||||
Initializes the {% data variables.product.prodname_codeql_runner %} and creates a {% data variables.product.prodname_codeql %} database for each language to be analyzed.
|
||||
|
||||
| Flag | Required | Input value |
|
||||
| ---- |:--------:| ----------- |
|
||||
| `--repository` | ✓ | Name of the repository to initialize. |
|
||||
| `--github-url` | ✓ | URL of the {{ site.data.variables.product.prodname_dotcom }} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {{ site.data.variables.product.prodname_github_apps }} token or personal access token. |
|
||||
| `--languages` | | Comma-separated list of languages to analyze. By default, the {{ site.data.variables.product.prodname_codeql_runner }} detects and analyzes all supported languages in the repository. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |
|
||||
| `--languages` | | Comma-separated list of languages to analyze. By default, the {% data variables.product.prodname_codeql_runner %} detects and analyzes all supported languages in the repository. |
|
||||
| `--queries` | | Comma-separated list of additional queries to run, in addition to the default suite of security queries. |
|
||||
| `--config-file` | | Path to custom configuration file. |
|
||||
| `--codeql-path` | | Path to a copy of the {{ site.data.variables.product.prodname_codeql }} CLI executable to use. By default, the {{ site.data.variables.product.prodname_codeql_runner }} downloads a copy. |
|
||||
| `--codeql-path` | | Path to a copy of the {% data variables.product.prodname_codeql %} CLI executable to use. By default, the {% data variables.product.prodname_codeql_runner %} downloads a copy. |
|
||||
| `--temp-dir` | | Directory where temporary files are stored. The default is _./codeql-runner_. |
|
||||
| `--tools-dir` | | Directory where {{ site.data.variables.product.prodname_codeql }} tools and other files are stored between runs. The default is a subdirectory of the home directory. |
|
||||
| `--tools-dir` | | Directory where {% data variables.product.prodname_codeql %} tools and other files are stored between runs. The default is a subdirectory of the home directory. |
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--debug` | | None. Prints more verbose output. |
|
||||
| `-h`, `--help` | | None. Displays help for the command. |
|
||||
|
||||
#### `autobuild`
|
||||
|
||||
Attempts to build the code for the compiled languages C/C++, C#, and Java. For those languages, {{ site.data.variables.product.prodname_codeql }} builds the code before analyzing it. Run `autobuild` between the `init` and `analyze` steps.
|
||||
Attempts to build the code for the compiled languages C/C++, C#, and Java. For those languages, {% data variables.product.prodname_codeql %} builds the code before analyzing it. Run `autobuild` between the `init` and `analyze` steps.
|
||||
|
||||
| Flag | Required | Input value |
|
||||
| ---- |:--------:| ----------- |
|
||||
| `--language` | | The language to build. By default, the {{ site.data.variables.product.prodname_codeql_runner }} builds the compiled language with the most files. |
|
||||
| `--language` | | The language to build. By default, the {% data variables.product.prodname_codeql_runner %} builds the compiled language with the most files. |
|
||||
| <nobr>`--temp-dir`</nobr> | | Directory where temporary files are stored. The default is _./codeql-runner_. |
|
||||
| `--debug` | | None. Prints more verbose output. |
|
||||
| `-h`, `--help` | | None. Displays help for the command. |
|
||||
|
||||
#### `analyze`
|
||||
|
||||
Analyzes the code in the {{ site.data.variables.product.prodname_codeql }} databases and uploads results to {{ site.data.variables.product.product_location }}.
|
||||
Analyzes the code in the {% data variables.product.prodname_codeql %} databases and uploads results to {% data variables.product.product_location %}.
|
||||
|
||||
| Flag | Required | Input value |
|
||||
| ---- |:--------:| ----------- |
|
||||
| `--repository` | ✓ | Name of the repository to analyze. |
|
||||
| `--commit` | ✓ | SHA of the commit to analyze. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
|
||||
| `--ref` | ✓ | Name of the reference to analyze, for example `refs/heads/main`. In Git and in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
|
||||
| `--github-url` | ✓ | URL of the {{ site.data.variables.product.prodname_dotcom }} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {{ site.data.variables.product.prodname_github_apps }} token or personal access token. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--no-upload` | | None. Stops the {{ site.data.variables.product.prodname_codeql_runner }} from uploading the results to {{ site.data.variables.product.product_location }}. |
|
||||
| `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_location %}. |
|
||||
| `--output-dir` | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. |
|
||||
| `--temp-dir` | | Directory where temporary files are stored. The default is _./codeql-runner_. |
|
||||
| `--debug` | | None. Prints more verbose output. |
|
||||
@@ -150,7 +150,7 @@ Analyzes the code in the {{ site.data.variables.product.prodname_codeql }} datab
|
||||
|
||||
#### `upload`
|
||||
|
||||
Uploads SARIF files to {{ site.data.variables.product.product_location }}.
|
||||
Uploads SARIF files to {% data variables.product.product_location %}.
|
||||
|
||||
| Flag | Required | Input value |
|
||||
| ---- |:--------:| ----------- |
|
||||
@@ -158,8 +158,8 @@ Uploads SARIF files to {{ site.data.variables.product.product_location }}.
|
||||
| `--repository` | ✓ | Name of the repository that was analyzed. |
|
||||
| `--commit` | ✓ | SHA of the commit that was analyzed. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
|
||||
| `--ref` | ✓ | Name of the reference that was analyzed, for example `refs/heads/main`. In Git and in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
|
||||
| `--github-url` | ✓ | URL of the {{ site.data.variables.product.prodname_dotcom }} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {{ site.data.variables.product.prodname_github_apps }} token or personal access token. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--debug` | | None. Prints more verbose output. |
|
||||
| `-h`, `--help` | | None. Displays help for the command. |
|
||||
|
||||
@@ -1,33 +1,33 @@
|
||||
---
|
||||
title: Configuring code scanning
|
||||
intro: 'You can configure how {{ site.data.variables.product.prodname_dotcom }} scans the code in your project for vulnerabilities and errors.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
permissions: 'People with write permissions to a repository can configure {{ site.data.variables.product.prodname_code_scanning }} for the repository.'
|
||||
intro: 'You can configure how {% data variables.product.prodname_dotcom %} scans the code in your project for vulnerabilities and errors.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'People with write permissions to a repository can configure {% data variables.product.prodname_code_scanning %} for the repository.'
|
||||
miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning-actions }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
||||
|
||||
### About {{ site.data.variables.product.prodname_code_scanning }} configuration
|
||||
### About {% data variables.product.prodname_code_scanning %} configuration
|
||||
|
||||
You can run {{ site.data.variables.product.prodname_code_scanning }} within {{ site.data.variables.product.product_location }}, using {{ site.data.variables.product.prodname_actions }}, or from your continuous integration (CI) system, using the {{ site.data.variables.product.prodname_codeql_runner }}. For more information about {{ site.data.variables.product.prodname_actions }}, see "[About {{ site.data.variables.product.prodname_actions }}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {{ site.data.variables.product.prodname_codeql_runner }}, see "[Running {{ site.data.variables.product.prodname_code_scanning }} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
You can run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_location %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
|
||||
This article relates to running {{ site.data.variables.product.prodname_code_scanning }} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{{ site.data.variables.product.prodname_ghe_server }}{% else %}{{ site.data.variables.product.prodname_dotcom }}{% endif %}.
|
||||
This article relates to running {% data variables.product.prodname_code_scanning %} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_ghe_server %}{% else %}{% data variables.product.prodname_dotcom %}{% endif %}.
|
||||
|
||||
Before you can configure {{ site.data.variables.product.prodname_code_scanning }} for a repository, you must enable {{ site.data.variables.product.prodname_code_scanning }} by adding a {{ site.data.variables.product.prodname_actions }} workflow to the repository. For more information, see "[Enabling {{ site.data.variables.product.prodname_code_scanning }} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
Before you can configure {% data variables.product.prodname_code_scanning %} for a repository, you must enable {% data variables.product.prodname_code_scanning %} by adding a {% data variables.product.prodname_actions %} workflow to the repository. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
|
||||
{{ site.data.reusables.code-scanning.edit-workflow }}
|
||||
{% data reusables.code-scanning.edit-workflow %}
|
||||
|
||||
{{ site.data.variables.product.prodname_codeql }} analysis is just one type of {{ site.data.variables.product.prodname_code_scanning }} you can do in {{ site.data.variables.product.prodname_dotcom }}. {{ site.data.variables.product.prodname_marketplace }}{% if currentVersion ver_gt "enterprise-server@2.21" %} on {{ site.data.variables.product.prodname_dotcom_the_website }}{% endif %} contains other {{ site.data.variables.product.prodname_code_scanning }} workflows you can use. {% if currentVersion == "free-pro-team@latest" %}You can find a selection of these on the "Get started with {{ site.data.variables.product.prodname_code_scanning }}" page, which you can access from the **{% octicon "shield" aria-label="The shield symbol" %} Security** tab.{% endif %} The specific examples given in this article relate to the {{ site.data.variables.product.prodname_codeql_workflow }} file.
|
||||
{% data variables.product.prodname_codeql %} analysis is just one type of {% data variables.product.prodname_code_scanning %} you can do in {% data variables.product.prodname_dotcom %}. {% data variables.product.prodname_marketplace %}{% if currentVersion ver_gt "enterprise-server@2.21" %} on {% data variables.product.prodname_dotcom_the_website %}{% endif %} contains other {% data variables.product.prodname_code_scanning %} workflows you can use. {% if currentVersion == "free-pro-team@latest" %}You can find a selection of these on the "Get started with {% data variables.product.prodname_code_scanning %}" page, which you can access from the **{% octicon "shield" aria-label="The shield symbol" %} Security** tab.{% endif %} The specific examples given in this article relate to the {% data variables.product.prodname_codeql_workflow %} file.
|
||||
|
||||
### Editing a {{ site.data.variables.product.prodname_code_scanning }} workflow
|
||||
### Editing a {% data variables.product.prodname_code_scanning %} workflow
|
||||
|
||||
{{ site.data.variables.product.prodname_dotcom }} saves workflow files in the _.github/workflows_ directory of your repository. You can find a workflow you have enabled by searching for its file name. For example, by default, the workflow file for {{ site.data.variables.product.prodname_codeql }} {{ site.data.variables.product.prodname_code_scanning }} is called _codeql-analysis.yml_.
|
||||
{% data variables.product.prodname_dotcom %} saves workflow files in the _.github/workflows_ directory of your repository. You can find a workflow you have enabled by searching for its file name. For example, by default, the workflow file for {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} is called _codeql-analysis.yml_.
|
||||
|
||||
1. In your repository, browse to the workflow file you want to edit.
|
||||
1. In the upper right corner of the file view, to open the workflow editor, click {% octicon "pencil" aria-label="The edit icon" %}.
|
||||
@@ -35,37 +35,37 @@ Before you can configure {{ site.data.variables.product.prodname_code_scanning }
|
||||
1. After you have edited the file, click **Start commit** and complete the "Commit changes" form. You can choose to commit directly to the current branch, or create a new branch and start a pull request.
|
||||
|
||||
|
||||
For more information about editing workflow files, see "[Learn {{ site.data.variables.product.prodname_actions }}](/actions/learn-github-actions)."
|
||||
For more information about editing workflow files, see "[Learn {% data variables.product.prodname_actions %}](/actions/learn-github-actions)."
|
||||
|
||||
### Configuring frequency
|
||||
|
||||
You can configure the {{ site.data.variables.product.prodname_codeql_workflow }} to scan code on a schedule or when specific events occur in a repository.
|
||||
You can configure the {% data variables.product.prodname_codeql_workflow %} to scan code on a schedule or when specific events occur in a repository.
|
||||
|
||||
Scanning code when someone pushes a change, and whenever a pull request is created, prevents developers from introducing new vulnerabilities and errors into the code. Scanning code on a schedule informs you about the latest vulnerabilities and errors that {{ site.data.variables.product.company_short }}, security researchers, and the community discover, even when developers aren't actively maintaining the repository.
|
||||
Scanning code when someone pushes a change, and whenever a pull request is created, prevents developers from introducing new vulnerabilities and errors into the code. Scanning code on a schedule informs you about the latest vulnerabilities and errors that {% data variables.product.company_short %}, security researchers, and the community discover, even when developers aren't actively maintaining the repository.
|
||||
|
||||
#### Scanning on push
|
||||
|
||||
By default, the {{ site.data.variables.product.prodname_codeql_workflow }} uses the `on.push` event to trigger a code scan on every push to the default branch of the repository and any protected branches. For {{ site.data.variables.product.prodname_code_scanning }} to be triggered on a specified branch, the workflow must exist in that branch. For more information, see "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions#on)."
|
||||
By default, the {% data variables.product.prodname_codeql_workflow %} uses the `on.push` event to trigger a code scan on every push to the default branch of the repository and any protected branches. For {% data variables.product.prodname_code_scanning %} to be triggered on a specified branch, the workflow must exist in that branch. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#on)."
|
||||
|
||||
#### Scanning pull requests
|
||||
|
||||
The default {{ site.data.variables.product.prodname_codeql_workflow }} uses the `pull_request` event to trigger a code scan on the `HEAD` commit of a pull request against the default branch. {% if currentVersion ver_gt "enterprise-server@2.21" %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see "[Disabling or limiting {{ site.data.variables.product.prodname_actions }} for a repository](/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks)."{% endif %}
|
||||
The default {% data variables.product.prodname_codeql_workflow %} uses the `pull_request` event to trigger a code scan on the `HEAD` commit of a pull request against the default branch. {% if currentVersion ver_gt "enterprise-server@2.21" %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see "[Disabling or limiting {% data variables.product.prodname_actions %} for a repository](/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks)."{% endif %}
|
||||
|
||||
For more information about the `pull_request` event, see "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestbranchestags)."
|
||||
For more information about the `pull_request` event, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestbranchestags)."
|
||||
|
||||
#### Scanning on a schedule
|
||||
|
||||
If you use the default {{ site.data.variables.product.prodname_codeql_workflow }}, the workflow will scan the code in your repository once a week, in addition to the scans triggered by events. To adjust this schedule, edit the `cron` value in the workflow. For more information, see "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions#onschedule)."
|
||||
If you use the default {% data variables.product.prodname_codeql_workflow %}, the workflow will scan the code in your repository once a week, in addition to the scans triggered by events. To adjust this schedule, edit the `cron` value in the workflow. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onschedule)."
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: {{ site.data.variables.product.prodname_dotcom }} only runs scheduled jobs that are in workflows on the default branch. Changing the schedule in a workflow on any other branch has no effect until you merge the branch into the default branch.
|
||||
**Note**: {% data variables.product.prodname_dotcom %} only runs scheduled jobs that are in workflows on the default branch. Changing the schedule in a workflow on any other branch has no effect until you merge the branch into the default branch.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
#### Example
|
||||
|
||||
The following example shows a {{ site.data.variables.product.prodname_codeql_workflow }} for a particular repository that has a default branch called `main` and one protected branch called `protected`.
|
||||
The following example shows a {% data variables.product.prodname_codeql_workflow %} for a particular repository that has a default branch called `main` and one protected branch called `protected`.
|
||||
|
||||
``` yaml
|
||||
on:
|
||||
@@ -84,7 +84,7 @@ This workflow scans:
|
||||
|
||||
### Specifying an operating system
|
||||
|
||||
If your code requires a specific operating system to compile, you can configure the operating system in your {{ site.data.variables.product.prodname_codeql_workflow }}. Edit the value of `jobs.analyze.runs-on` to specify the operating system for the machine that runs your {{ site.data.variables.product.prodname_code_scanning }} actions. {% if currentVersion ver_gt "enterprise-server@2.21" %}You specify the operating system by using an appropriate label as the second element in a two-element array, after `self-hosted`.{% else %}
|
||||
If your code requires a specific operating system to compile, you can configure the operating system in your {% data variables.product.prodname_codeql_workflow %}. Edit the value of `jobs.analyze.runs-on` to specify the operating system for the machine that runs your {% data variables.product.prodname_code_scanning %} actions. {% if currentVersion ver_gt "enterprise-server@2.21" %}You specify the operating system by using an appropriate label as the second element in a two-element array, after `self-hosted`.{% else %}
|
||||
|
||||
If you choose to use a self-hosted runner for code scanning, you can specify an operating system by using an appropriate label as the second element in a two-element array, after `self-hosted`.{% endif %}
|
||||
|
||||
@@ -97,21 +97,21 @@ jobs:
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners)" and "[Adding self-hosted runners](/actions/hosting-your-own-runners/adding-self-hosted-runners)."{% endif %}
|
||||
|
||||
{{ site.data.variables.product.prodname_codeql }} {{ site.data.variables.product.prodname_code_scanning }} supports the latest versions of Ubuntu, Windows, and macOS. Typical values for this setting are therefore: `ubuntu-latest`, `windows-latest`, and `macos-latest`. For more information, see {% if currentVersion ver_gt "enterprise-server@2.21" %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#self-hosted-runners)" and "[Using labels with self-hosted runners](/actions/hosting-your-own-runners/using-labels-with-self-hosted-runners){% else %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idruns-on){% endif %}."
|
||||
{% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} supports the latest versions of Ubuntu, Windows, and macOS. Typical values for this setting are therefore: `ubuntu-latest`, `windows-latest`, and `macos-latest`. For more information, see {% if currentVersion ver_gt "enterprise-server@2.21" %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#self-hosted-runners)" and "[Using labels with self-hosted runners](/actions/hosting-your-own-runners/using-labels-with-self-hosted-runners){% else %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idruns-on){% endif %}."
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}You must ensure that Git is in the PATH variable on your self-hosted runners.{% else %}If you use a self-hosted runner, you must ensure that Git is in the PATH variable.{% endif %}
|
||||
|
||||
### Changing the languages that are analyzed
|
||||
|
||||
{{ site.data.variables.product.prodname_codeql }} {{ site.data.variables.product.prodname_code_scanning }} automatically detects code written in the supported languages.
|
||||
{% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} automatically detects code written in the supported languages.
|
||||
|
||||
{{ site.data.reusables.code-scanning.supported-languages }}
|
||||
{% data reusables.code-scanning.supported-languages %}
|
||||
|
||||
The default {{ site.data.variables.product.prodname_codeql_workflow }} file contains a build matrix called `language` which lists the languages in your repository that are analyzed. {{ site.data.variables.product.prodname_codeql }} automatically populates this matrix when you add {{ site.data.variables.product.prodname_code_scanning }} to a repository. Using the `language` matrix optimizes {{ site.data.variables.product.prodname_codeql }} to run each analysis in parallel. We recommend that all workflows adopt this configuration due to the performance benefits of parallelizing builds. For more information about build matrices, see "[Managing complex workflows](/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix)."
|
||||
The default {% data variables.product.prodname_codeql_workflow %} file contains a build matrix called `language` which lists the languages in your repository that are analyzed. {% data variables.product.prodname_codeql %} automatically populates this matrix when you add {% data variables.product.prodname_code_scanning %} to a repository. Using the `language` matrix optimizes {% data variables.product.prodname_codeql %} to run each analysis in parallel. We recommend that all workflows adopt this configuration due to the performance benefits of parallelizing builds. For more information about build matrices, see "[Managing complex workflows](/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix)."
|
||||
|
||||
{{ site.data.reusables.code-scanning.specify-language-to-analyze }}
|
||||
{% data reusables.code-scanning.specify-language-to-analyze %}
|
||||
|
||||
If your workflow uses the `language` matrix then {{ site.data.variables.product.prodname_codeql }} is hardcoded to analyze only the languages in the matrix. To change the languages you want to analyze, edit the value of the matrix variable. You can remove a language to prevent it being analyzed or you can add a language that was not present in the repository when {{ site.data.variables.product.prodname_code_scanning }} was enabled. For example, if the repository initially only contained JavaScript when {{ site.data.variables.product.prodname_code_scanning }} was enabled, and you later added Python code, you will need to add `python` to the matrix.
|
||||
If your workflow uses the `language` matrix then {% data variables.product.prodname_codeql %} is hardcoded to analyze only the languages in the matrix. To change the languages you want to analyze, edit the value of the matrix variable. You can remove a language to prevent it being analyzed or you can add a language that was not present in the repository when {% data variables.product.prodname_code_scanning %} was enabled. For example, if the repository initially only contained JavaScript when {% data variables.product.prodname_code_scanning %} was enabled, and you later added Python code, you will need to add `python` to the matrix.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
@@ -124,7 +124,7 @@ jobs:
|
||||
language: ['javascript', 'python']
|
||||
```
|
||||
|
||||
If your workflow does not contain a matrix called `language`, then {{ site.data.variables.product.prodname_codeql }} is configured to run analysis sequentially. If you don't specify languages in the workflow, {{ site.data.variables.product.prodname_codeql }} automatically detects, and attempts to analyze, any supported languages in the repository. If you want to choose which languages to analyze, without using a matrix, you can use the `languages` parameter under the `init` action.
|
||||
If your workflow does not contain a matrix called `language`, then {% data variables.product.prodname_codeql %} is configured to run analysis sequentially. If you don't specify languages in the workflow, {% data variables.product.prodname_codeql %} automatically detects, and attempts to analyze, any supported languages in the repository. If you want to choose which languages to analyze, without using a matrix, you can use the `languages` parameter under the `init` action.
|
||||
|
||||
```yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
@@ -134,7 +134,7 @@ If your workflow does not contain a matrix called `language`, then {{ site.data
|
||||
|
||||
### Running additional queries
|
||||
|
||||
{{ site.data.reusables.code-scanning.run-additional-queries }}
|
||||
{% data reusables.code-scanning.run-additional-queries %}
|
||||
|
||||
To add one or more queries, add a `with: queries:` entry within the `uses: github/codeql-action/init@v1` section of the workflow.
|
||||
|
||||
@@ -146,7 +146,7 @@ To add one or more queries, add a `with: queries:` entry within the `uses: githu
|
||||
|
||||
You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language.
|
||||
|
||||
{{ site.data.reusables.code-scanning.codeql-query-suites }}
|
||||
{% data reusables.code-scanning.codeql-query-suites %}
|
||||
|
||||
If you are also using a configuration file for custom settings, any additional queries specified in your workflow are used instead of any specified in the configuration file. If you want to run the combined set of additional queries specified here and in the configuration file, prefix the value of `queries` in the workflow with the `+` symbol. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)."
|
||||
|
||||
@@ -194,7 +194,7 @@ If you only want to run custom queries, you can disable the default security que
|
||||
|
||||
#### Specifying directories to scan
|
||||
|
||||
For the interpreted languages that {{ site.data.variables.product.prodname_codeql }} supports (Python and JavaScript/TypeScript), you can restrict {{ site.data.variables.product.prodname_code_scanning }} to files in specific directories by adding a `paths` array to the configuration file. You can exclude the files in specific directories from scans by adding a `paths-ignore` array.
|
||||
For the interpreted languages that {% data variables.product.prodname_codeql %} supports (Python and JavaScript/TypeScript), you can restrict {% data variables.product.prodname_code_scanning %} to files in specific directories by adding a `paths` array to the configuration file. You can exclude the files in specific directories from scans by adding a `paths-ignore` array.
|
||||
|
||||
``` yaml
|
||||
paths:
|
||||
@@ -208,30 +208,30 @@ paths-ignore:
|
||||
|
||||
**Note**:
|
||||
|
||||
* The `paths` and `paths-ignore` keywords, used in the context of the {{ site.data.variables.product.prodname_code_scanning }} configuration file, should not be confused with the same keywords when used for `on.<push|pull_request>.paths` in a workflow. When they are used to modify `on.<push|pull_request>` in a workflow, they determine whether the actions will be run when someone modifies code in the specified directories. For more information, see "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpaths)."
|
||||
* The `paths` and `paths-ignore` keywords, used in the context of the {% data variables.product.prodname_code_scanning %} configuration file, should not be confused with the same keywords when used for `on.<push|pull_request>.paths` in a workflow. When they are used to modify `on.<push|pull_request>` in a workflow, they determine whether the actions will be run when someone modifies code in the specified directories. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpaths)."
|
||||
* `**` characters can only be at the start or end of a line, or surrounded by slashes, and you can't mix `**` and other characters. For example, `foo/**`, `**/foo`, and `foo/**/bar` are all allowed syntax, but `**foo` isn't. However you can use single stars along with other characters, as shown in the example. You'll need to quote anything that contains a `*` character.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
For C/C++, C#, and Java, if you want to limit {{ site.data.variables.product.prodname_code_scanning }} to specific directories in your project, you must specify appropriate build steps in the workflow. The commands you need to use to exclude a directory from the build will depend on your build system. For more information, see "[Configuring the {{ site.data.variables.product.prodname_codeql }} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
For C/C++, C#, and Java, if you want to limit {% data variables.product.prodname_code_scanning %} to specific directories in your project, you must specify appropriate build steps in the workflow. The commands you need to use to exclude a directory from the build will depend on your build system. For more information, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
|
||||
You can quickly analyze small portions of a monorepo when you modify code in specific directories. You'll need to both exclude directories in your build steps and use the `paths-ignore` and `paths` keywords for [`on.<push|pull_request>`](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpaths) in your workflow.
|
||||
|
||||
#### Example configuration files
|
||||
|
||||
{{ site.data.reusables.code-scanning.example-configuration-files }}
|
||||
{% data reusables.code-scanning.example-configuration-files %}
|
||||
|
||||
### Configuring {{ site.data.variables.product.prodname_code_scanning }} for compiled languages
|
||||
### Configuring {% data variables.product.prodname_code_scanning %} for compiled languages
|
||||
|
||||
{{ site.data.reusables.code-scanning.autobuild-compiled-languages }} In contrast to the other compiled languages, CodeQL can successfully analyze Go without building the code.
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %} In contrast to the other compiled languages, CodeQL can successfully analyze Go without building the code.
|
||||
|
||||
{{ site.data.reusables.code-scanning.autobuild-add-build-steps }} For more information about how to configure {{ site.data.variables.product.prodname_codeql }} {{ site.data.variables.product.prodname_code_scanning }} for compiled languages, see "[Configuring the {{ site.data.variables.product.prodname_codeql }} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages)."
|
||||
{% data reusables.code-scanning.autobuild-add-build-steps %} For more information about how to configure {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} for compiled languages, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages)."
|
||||
|
||||
### Accessing private repositories
|
||||
|
||||
If your workflow for {{ site.data.variables.product.prodname_code_scanning }} accesses a private repository, other than the repository that contains the workflow, you'll need to configure Git to authenticate with a personal access token. Define the secret in the runner environment by using `jobs.<job_id>.steps.env` in your workflow before any {{ site.data.variables.product.prodname_codeql }} actions. For more information, see "[Creating a personal access token for the command line](/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)" and "[Creating and storing encrypted secrets](/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets)."
|
||||
If your workflow for {% data variables.product.prodname_code_scanning %} accesses a private repository, other than the repository that contains the workflow, you'll need to configure Git to authenticate with a personal access token. Define the secret in the runner environment by using `jobs.<job_id>.steps.env` in your workflow before any {% data variables.product.prodname_codeql %} actions. For more information, see "[Creating a personal access token for the command line](/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)" and "[Creating and storing encrypted secrets](/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets)."
|
||||
|
||||
For example, the following configuration has Git replace the full URLs to the `github/foo`, `github/bar`, and `github/baz` repositories on {{ site.data.variables.product.prodname_dotcom_the_website }} with URLs that include the personal access token that you store in the `ACCESS_TOKEN` environment variable.
|
||||
For example, the following configuration has Git replace the full URLs to the `github/foo`, `github/bar`, and `github/baz` repositories on {% data variables.product.prodname_dotcom_the_website %} with URLs that include the personal access token that you store in the `ACCESS_TOKEN` environment variable.
|
||||
|
||||
{% raw %}
|
||||
```yaml
|
||||
@@ -246,6 +246,6 @@ steps:
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
### Uploading {{ site.data.variables.product.prodname_code_scanning }} data to {{ site.data.variables.product.prodname_dotcom }}
|
||||
### Uploading {% data variables.product.prodname_code_scanning %} data to {% data variables.product.prodname_dotcom %}
|
||||
|
||||
{{ site.data.variables.product.prodname_dotcom }} can display code analysis data generated externally by a third-party tool. You can upload code analysis data with the `upload-sarif` action. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)."
|
||||
{% data variables.product.prodname_dotcom %} can display code analysis data generated externally by a third-party tool. You can upload code analysis data with the `upload-sarif` action. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)."
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: Configuring the CodeQL workflow for compiled languages
|
||||
shortTitle: Configuring for compiled languages
|
||||
intro: 'You can configure how {{ site.data.variables.product.prodname_dotcom }} uses the {{ site.data.variables.product.prodname_codeql_workflow }} to scan code written in compiled languages for vulnerabilities and errors.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
permissions: 'People with write permissions to a repository can configure {{ site.data.variables.product.prodname_code_scanning }} for the repository.'
|
||||
intro: 'You can configure how {% data variables.product.prodname_dotcom %} uses the {% data variables.product.prodname_codeql_workflow %} to scan code written in compiled languages for vulnerabilities and errors.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'People with write permissions to a repository can configure {% data variables.product.prodname_code_scanning %} for the repository.'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-for-compiled-languages
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-action-for-compiled-languages
|
||||
@@ -12,27 +12,27 @@ versions:
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning-actions }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
||||
### About the {{ site.data.variables.product.prodname_codeql_workflow }} and compiled languages
|
||||
### About the {% data variables.product.prodname_codeql_workflow %} and compiled languages
|
||||
|
||||
You enable {{ site.data.variables.product.prodname_dotcom }} to run {{ site.data.variables.product.prodname_code_scanning }} for your repository by adding a {{ site.data.variables.product.prodname_actions }} workflow to the repository. For {{ site.data.variables.product.prodname_codeql }} {{ site.data.variables.product.prodname_code_scanning }}, you add the {{ site.data.variables.product.prodname_codeql_workflow }}. For more information, see "[Enabling {{ site.data.variables.product.prodname_code_scanning }} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
You enable {% data variables.product.prodname_dotcom %} to run {% data variables.product.prodname_code_scanning %} for your repository by adding a {% data variables.product.prodname_actions %} workflow to the repository. For {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}, you add the {% data variables.product.prodname_codeql_workflow %}. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
|
||||
{{ site.data.reusables.code-scanning.edit-workflow }}
|
||||
For general information about configuring {{ site.data.variables.product.prodname_code_scanning }} and editing workflow files, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)" and "[Learn {{ site.data.variables.product.prodname_actions }}](/actions/learn-github-actions)."
|
||||
{% data reusables.code-scanning.edit-workflow %}
|
||||
For general information about configuring {% data variables.product.prodname_code_scanning %} and editing workflow files, see "[Configuring {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)" and "[Learn {% data variables.product.prodname_actions %}](/actions/learn-github-actions)."
|
||||
|
||||
### About autobuild for {{ site.data.variables.product.prodname_codeql }}
|
||||
### About autobuild for {% data variables.product.prodname_codeql %}
|
||||
|
||||
Code scanning works by running queries against one or more databases. Each database contains a representation of all of the code in a single language in your repository. For the compiled languages C/C++, C#, and Java, the process of populating this database involves building the code and extracting data. In contrast to the other compiled languages, CodeQL can generate a database for Go without building the code.
|
||||
|
||||
{{ site.data.reusables.code-scanning.autobuild-compiled-languages }}
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %}
|
||||
|
||||
If your workflow uses a `language` matrix, `autobuild` attempts to build each of the compiled languages listed in the matrix. Without a matrix `autobuild` attempts to build the supported compiled language that has the most source files in the repository. With the exception of Go, analysis of other compiled languages in your repository will fail unless you supply explicit build commands.
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note**: If you use self-hosted runners for {{ site.data.variables.product.prodname_actions }}, you may need to install additional software to use the `autobuild` process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. For more information, see "[Specifications for {{ site.data.variables.product.prodname_dotcom }}-hosted runners](/actions/reference/specifications-for-github-hosted-runners/#supported-software)".
|
||||
**Note**: If you use self-hosted runners for {% data variables.product.prodname_actions %}, you may need to install additional software to use the `autobuild` process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. For more information, see "[Specifications for {% data variables.product.prodname_dotcom %}-hosted runners](/actions/reference/specifications-for-github-hosted-runners/#supported-software)".
|
||||
|
||||
{% endnote %}
|
||||
|
||||
@@ -84,7 +84,7 @@ The `autobuild` process tries to determine the build system for Java codebases b
|
||||
|
||||
### Adding build steps for a compiled language
|
||||
|
||||
{{ site.data.reusables.code-scanning.autobuild-add-build-steps }} For information on how to edit the workflow file, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#editing-a-code-scanning-workflow)."
|
||||
{% data reusables.code-scanning.autobuild-add-build-steps %} For information on how to edit the workflow file, see "[Configuring {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#editing-a-code-scanning-workflow)."
|
||||
|
||||
After removing the `autobuild` step, uncomment the `run` step and add build commands that are suitable for your repository. The workflow `run` step runs command-line programs using the operating system's shell. You can modify these commands and add more commands to customize the build process.
|
||||
|
||||
@@ -94,7 +94,7 @@ After removing the `autobuild` step, uncomment the `run` step and add build comm
|
||||
make release
|
||||
```
|
||||
|
||||
For more information about the `run` keyword, see "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun)."
|
||||
For more information about the `run` keyword, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun)."
|
||||
|
||||
If your repository contains multiple compiled languages, you can specify language-specific build commands. For example, if your repository contains C/C++, C# and Java, and `autobuild` correctly builds C/C++ and C# but fails to build Java, you could use the following configuration in your workflow, after the `init` step. This specifies build steps for Java while still using `autobuild` for C/C++ and C#:
|
||||
|
||||
@@ -112,6 +112,6 @@ If your repository contains multiple compiled languages, you can specify languag
|
||||
|
||||
For more information about the `if` conditional, see "[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsif)."
|
||||
|
||||
For more tips and tricks about why `autobuild` won't build your code, see "[Troubleshooting the {{ site.data.variables.product.prodname_codeql }} workflow](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-the-codeql-workflow)."
|
||||
For more tips and tricks about why `autobuild` won't build your code, see "[Troubleshooting the {% data variables.product.prodname_codeql %} workflow](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-the-codeql-workflow)."
|
||||
|
||||
If you added manual build steps for compiled languages and {{ site.data.variables.product.prodname_code_scanning }} is still not working on your repository, contact {{ site.data.variables.contact.contact_support }}.
|
||||
If you added manual build steps for compiled languages and {% data variables.product.prodname_code_scanning %} is still not working on your repository, contact {% data variables.contact.contact_support %}.
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: Enabling code scanning for a repository
|
||||
shortTitle: Enabling code scanning
|
||||
intro: 'You can enable {{ site.data.variables.product.prodname_code_scanning }} for your project''s repository.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
permissions: 'People with write permissions to a repository can enable {{ site.data.variables.product.prodname_code_scanning }} for the repository.'
|
||||
intro: 'You can enable {% data variables.product.prodname_code_scanning %} for your project''s repository.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'People with write permissions to a repository can enable {% data variables.product.prodname_code_scanning %} for the repository.'
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/configuring-automated-code-scanning
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning
|
||||
@@ -12,38 +12,38 @@ versions:
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning-actions }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
||||
### Options for enabling {{ site.data.variables.product.prodname_code_scanning }}
|
||||
### Options for enabling {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
You decide how you generate {{ site.data.variables.product.prodname_code_scanning }} alerts, and which tools you use, at a repository level. {{ site.data.variables.product.product_name }} provides fully integrated support for {{ site.data.variables.product.prodname_codeql }} analysis, and also supports analysis using third-party tools. For more information, see "[About {{ site.data.variables.product.prodname_codeql }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning#about-codeql)."
|
||||
You decide how you generate {% data variables.product.prodname_code_scanning %} alerts, and which tools you use, at a repository level. {% data variables.product.product_name %} provides fully integrated support for {% data variables.product.prodname_codeql %} analysis, and also supports analysis using third-party tools. For more information, see "[About {% data variables.product.prodname_codeql %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning#about-codeql)."
|
||||
|
||||
{{ site.data.reusables.code-scanning.enabling-options }}
|
||||
{% data reusables.code-scanning.enabling-options %}
|
||||
|
||||
### Enabling {{ site.data.variables.product.prodname_code_scanning }} using actions
|
||||
### Enabling {% data variables.product.prodname_code_scanning %} using actions
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}Using actions to run {{ site.data.variables.product.prodname_code_scanning }} will use minutes. For more information, see "[About billing for {{ site.data.variables.product.prodname_actions }}](/github/setting-up-and-managing-billing-and-payments-on-github/about-billing-for-github-actions)."{% endif %}
|
||||
{% if currentVersion == "free-pro-team@latest" %}Using actions to run {% data variables.product.prodname_code_scanning %} will use minutes. For more information, see "[About billing for {% data variables.product.prodname_actions %}](/github/setting-up-and-managing-billing-and-payments-on-github/about-billing-for-github-actions)."{% endif %}
|
||||
|
||||
{{ site.data.reusables.repositories.navigate-to-repo }}
|
||||
{{ site.data.reusables.repositories.sidebar-security }}
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
3. To the right of "Code scanning", click **Set up code scanning**.
|
||||
|
||||
4. Under "Get started with code scanning", click **Set up this workflow** on the {{ site.data.variables.product.prodname_codeql_workflow }} or on a third-party workflow.
|
||||
4. Under "Get started with code scanning", click **Set up this workflow** on the {% data variables.product.prodname_codeql_workflow %} or on a third-party workflow.
|
||||
|
||||
5. Optionally, to customize how {{ site.data.variables.product.prodname_code_scanning }} scans your code, edit the workflow. For more information, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)."
|
||||
5. Optionally, to customize how {% data variables.product.prodname_code_scanning %} scans your code, edit the workflow. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)."
|
||||
6. Use the **Start commit** drop-down, and type a commit message.
|
||||
|
||||
7. Choose whether you'd like to commit directly to the default branch, or create a new branch and start a pull request.
|
||||
|
||||
8. Click **Commit new file** or **Propose new file**.
|
||||
|
||||
After you commit the workflow file or create a pull request, {{ site.data.variables.product.prodname_code_scanning }} will analyze your code according to the frequency you specified in your workflow file. If you created a pull request, {{ site.data.variables.product.prodname_code_scanning }} will only analyze the code on the pull request's topic branch until you merge the pull request into the default branch of the repository.
|
||||
After you commit the workflow file or create a pull request, {% data variables.product.prodname_code_scanning %} will analyze your code according to the frequency you specified in your workflow file. If you created a pull request, {% data variables.product.prodname_code_scanning %} will only analyze the code on the pull request's topic branch until you merge the pull request into the default branch of the repository.
|
||||
|
||||
### Next steps
|
||||
|
||||
After you enable {{ site.data.variables.product.prodname_code_scanning }}, you can monitor analysis, view results, and further customize how you scan your code.
|
||||
After you enable {% data variables.product.prodname_code_scanning %}, you can monitor analysis, view results, and further customize how you scan your code.
|
||||
|
||||
- You can view the run status of {{ site.data.variables.product.prodname_code_scanning }} and get notifications for completed runs. For more information, see "[Managing a workflow run](/actions/configuring-and-managing-workflows/managing-a-workflow-run)" and "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-actions-notification-options)."
|
||||
- After a scan completes, you can view alerts from a completed scan. For more information, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
- You can customize how {{ site.data.variables.product.prodname_code_scanning }} scans the code in your repository. For more information, see "[Configuring code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)."
|
||||
- You can view the run status of {% data variables.product.prodname_code_scanning %} and get notifications for completed runs. For more information, see "[Managing a workflow run](/actions/configuring-and-managing-workflows/managing-a-workflow-run)" and "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-actions-notification-options)."
|
||||
- After a scan completes, you can view alerts from a completed scan. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
- You can customize how {% data variables.product.prodname_code_scanning %} scans the code in your repository. For more information, see "[Configuring code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)."
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Integrating with code scanning
|
||||
shortTitle: Integration
|
||||
intro: 'You can integrate {{ site.data.variables.product.prodname_codeql }} {{ site.data.variables.product.prodname_code_scanning }} with your existing CI systems or upload results from other tools.'
|
||||
intro: 'You can integrate {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI systems or upload results from other tools.'
|
||||
mapTopic: true
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/managing-results-from-code-scanning
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
title: Managing code scanning alerts for your repository
|
||||
shortTitle: Managing alerts
|
||||
intro: 'You can view, fix, and close alerts for potential vulnerabilities or errors in your project''s code.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
permissions: 'People with write permission to a repository can manage {{ site.data.variables.product.prodname_code_scanning }} alerts for the repository.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'People with write permission to a repository can manage {% data variables.product.prodname_code_scanning %} alerts for the repository.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
@@ -12,55 +12,55 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/managing-alerts-from-code-scanning
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### About alerts from {{ site.data.variables.product.prodname_code_scanning }}
|
||||
### About alerts from {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
You can set up {{ site.data.variables.product.prodname_code_scanning }} to check the code in a repository using the default {{ site.data.variables.product.prodname_codeql }} analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by {{ site.data.variables.product.company_short }}'s default {{ site.data.variables.product.prodname_codeql }} analysis. For more information, see "[Enabling {{ site.data.variables.product.prodname_code_scanning }} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
You can set up {% data variables.product.prodname_code_scanning %} to check the code in a repository using the default {% data variables.product.prodname_codeql %} analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by {% data variables.product.company_short %}'s default {% data variables.product.prodname_codeql %} analysis. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
|
||||
By default, {{ site.data.variables.product.prodname_code_scanning }} analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "[Triaging {{ site.data.variables.product.prodname_code_scanning }} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
By default, {% data variables.product.prodname_code_scanning %} analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
|
||||
### About alerts details
|
||||
|
||||
Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the severity and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by {{ site.data.variables.product.prodname_codeql }} analysis, you will also see information on how to fix the problem.
|
||||
Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the severity and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by {% data variables.product.prodname_codeql %} analysis, you will also see information on how to fix the problem.
|
||||
|
||||
|
||||
|
||||
|
||||
If you enable {{ site.data.variables.product.prodname_code_scanning }} using {{ site.data.variables.product.prodname_codeql }}, this can also detect data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.
|
||||
If you enable {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, this can also detect data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.
|
||||
|
||||
When {{ site.data.variables.product.prodname_code_scanning }} reports data-flow alerts, {{ site.data.variables.product.prodname_dotcom }} shows you how data moves through the code. {{ site.data.variables.product.prodname_code_scanning_capc }} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.
|
||||
When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_capc %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.
|
||||
|
||||
### Viewing an alert
|
||||
|
||||
Anyone with read permission for a repository can see {{ site.data.variables.product.prodname_code_scanning }} alerts on pull requests. However, you need write permission to view a summary of alerts for repository on the **Security** tab. By default, alerts are shown for the default branch.
|
||||
Anyone with read permission for a repository can see {% data variables.product.prodname_code_scanning %} alerts on pull requests. However, you need write permission to view a summary of alerts for repository on the **Security** tab. By default, alerts are shown for the default branch.
|
||||
|
||||
{{ site.data.reusables.repositories.navigate-to-repo }}
|
||||
{{ site.data.reusables.repositories.sidebar-security }}
|
||||
{{ site.data.reusables.repositories.sidebar-code-scanning-alerts }}
|
||||
{{ site.data.reusables.code-scanning.click-alert-in-list }}
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-code-scanning-alerts %}
|
||||
{% data reusables.code-scanning.click-alert-in-list %}
|
||||
5. Optionally, if the alert highlights a problem with data flow, click **Show paths** to display the path from the data source to the sink where it's used.
|
||||
|
||||
|
||||
### Fixing an alert
|
||||
|
||||
Anyone with write permission for a repository can fix an alert by committing a correction to the code. If the repository has {{ site.data.variables.product.prodname_code_scanning }} scheduled to run on pull requests, it's best to raise a pull request with your correction. This will trigger {{ site.data.variables.product.prodname_code_scanning }} analysis of the changes and test that your fix doesn't introduce any new problems. For more information, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)" and "[Triaging {{ site.data.variables.product.prodname_code_scanning }} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
Anyone with write permission for a repository can fix an alert by committing a correction to the code. If the repository has {% data variables.product.prodname_code_scanning %} scheduled to run on pull requests, it's best to raise a pull request with your correction. This will trigger {% data variables.product.prodname_code_scanning %} analysis of the changes and test that your fix doesn't introduce any new problems. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)" and "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
|
||||
### Closing an alert
|
||||
|
||||
Closing an alert is a way to resolve an alert that you don't think needs to be fixed. {{ site.data.reusables.code-scanning.close-alert-examples }}
|
||||
Closing an alert is a way to resolve an alert that you don't think needs to be fixed. {% data reusables.code-scanning.close-alert-examples %}
|
||||
|
||||
{{ site.data.reusables.repositories.navigate-to-repo }}
|
||||
{{ site.data.reusables.repositories.sidebar-security }}
|
||||
{{ site.data.reusables.repositories.sidebar-code-scanning-alerts }}
|
||||
{{ site.data.reusables.code-scanning.click-alert-in-list }}
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-code-scanning-alerts %}
|
||||
{% data reusables.code-scanning.click-alert-in-list %}
|
||||
5. Select the Close drop-down menu and click a reason for closing the alert.
|
||||
|
||||
|
||||
{{ site.data.reusables.code-scanning.false-positive-fix-codeql }}
|
||||
{% data reusables.code-scanning.false-positive-fix-codeql %}
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Triaging {{ site.data.variables.product.prodname_code_scanning }} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)"
|
||||
- "[Enabling {{ site.data.variables.product.prodname_code_scanning }} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)"
|
||||
- "[About integration with {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning)"
|
||||
- "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)"
|
||||
- "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)"
|
||||
- "[About integration with {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning)"
|
||||
|
||||
@@ -1,29 +1,29 @@
|
||||
---
|
||||
title: Running code scanning in your CI system
|
||||
shortTitle: Running in your CI
|
||||
intro: 'If you use a third-party continuous integration system, you can integrate {{ site.data.variables.product.prodname_codeql }} {{ site.data.variables.product.prodname_code_scanning }} into this system using the {{ site.data.variables.product.prodname_codeql_runner }}.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: 'If you use a third-party continuous integration system, you can integrate {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} into this system using the {% data variables.product.prodname_codeql_runner %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### About the {{ site.data.variables.product.prodname_codeql_runner }}
|
||||
### About the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
{{ site.data.reusables.code-scanning.about-code-scanning }} For information, see "[About {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)."
|
||||
{% data reusables.code-scanning.about-code-scanning %} For information, see "[About {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)."
|
||||
|
||||
You can use the {{ site.data.variables.product.prodname_codeql_runner }} to run {{ site.data.variables.product.prodname_code_scanning }} on code that you're processing in a third-party continuous integration (CI) system. Alternatively, you can use {{ site.data.variables.product.prodname_actions }} to run {{ site.data.variables.product.prodname_code_scanning }} on {{ site.data.variables.product.product_location }}. For information, see "[Enabling {{ site.data.variables.product.prodname_code_scanning }} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
You can use the {% data variables.product.prodname_codeql_runner %} to run {% data variables.product.prodname_code_scanning %} on code that you're processing in a third-party continuous integration (CI) system. Alternatively, you can use {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_location %}. For information, see "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
|
||||
The {{ site.data.variables.product.prodname_codeql_runner }} is a command-line tool that runs {{ site.data.variables.product.prodname_codeql }} analysis on a checkout of a {{ site.data.variables.product.prodname_dotcom }} repository. You add the runner to your third-party system, then call the runner to analyze code and upload the results to {{ site.data.variables.product.product_location }}. These results are displayed as {{ site.data.variables.product.prodname_code_scanning }} alerts in the repository.
|
||||
The {% data variables.product.prodname_codeql_runner %} is a command-line tool that runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. You add the runner to your third-party system, then call the runner to analyze code and upload the results to {% data variables.product.product_location %}. These results are displayed as {% data variables.product.prodname_code_scanning %} alerts in the repository.
|
||||
|
||||
{{ site.data.reusables.code-scanning.codeql-runner-license }}
|
||||
{% data reusables.code-scanning.codeql-runner-license %}
|
||||
|
||||
### Downloading the {{ site.data.variables.product.prodname_codeql_runner }}
|
||||
### Downloading the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
You can download the {{ site.data.variables.product.prodname_codeql_runner }} from https://github.com/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
You can download the {% data variables.product.prodname_codeql_runner %} from https://github.com/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
|
||||
On Linux:
|
||||
|
||||
@@ -38,54 +38,54 @@ chmod +x codeql-runner-macos
|
||||
sudo xattr -d com.apple.quarantine codeql-runner-macos
|
||||
```
|
||||
|
||||
### Adding the {{ site.data.variables.product.prodname_codeql_runner }} to your CI system
|
||||
### Adding the {% data variables.product.prodname_codeql_runner %} to your CI system
|
||||
|
||||
Once you have downloaded the {{ site.data.variables.product.prodname_codeql_runner }} and verified that it can be executed, you should make the runner available to each CI server that you intend to use for {{ site.data.variables.product.prodname_code_scanning }}. In addition to this, each CI server also needs:
|
||||
Once you have downloaded the {% data variables.product.prodname_codeql_runner %} and verified that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. In addition to this, each CI server also needs:
|
||||
|
||||
- A {{ site.data.variables.product.prodname_github_apps }} or personal access token for the {{ site.data.variables.product.prodname_codeql_runner }} to use. For private repositories the token must have the `repo` scope. For public the token needs only the `public_repo` and `repo:security_events` scopes. For information, see "[Building {{ site.data.variables.product.prodname_github_apps }}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- Access to the {{ site.data.variables.product.prodname_codeql }} bundle associated with this release of the {{ site.data.variables.product.prodname_codeql_runner }}. This package contains the {{ site.data.variables.product.prodname_codeql }} CLI, queries, and libraries needed for {{ site.data.variables.product.prodname_codeql }} analysis. For information, see "[{{ site.data.variables.product.prodname_codeql }} CLI](https://help.semmle.com/codeql/codeql-cli.html)."
|
||||
- A {% data variables.product.prodname_github_apps %} or personal access token for the {% data variables.product.prodname_codeql_runner %} to use. For private repositories the token must have the `repo` scope. For public the token needs only the `public_repo` and `repo:security_events` scopes. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- Access to the {% data variables.product.prodname_codeql %} bundle associated with this release of the {% data variables.product.prodname_codeql_runner %}. This package contains the {% data variables.product.prodname_codeql %} CLI, queries, and libraries needed for {% data variables.product.prodname_codeql %} analysis. For information, see "[{% data variables.product.prodname_codeql %} CLI](https://help.semmle.com/codeql/codeql-cli.html)."
|
||||
|
||||
The options for providing access to the {{ site.data.variables.product.prodname_codeql }} bundle are:
|
||||
The options for providing access to the {% data variables.product.prodname_codeql %} bundle are:
|
||||
|
||||
1. Allow the CI servers access to {{ site.data.variables.product.prodname_dotcom_the_website }} so that the {{ site.data.variables.product.prodname_codeql_runner }} can download the bundle automatically.
|
||||
1. Manually download/extract the bundle, store it with other central resources, and use the `--codeql-path` flag to specify the location of the bundle in calls to initialize the {{ site.data.variables.product.prodname_codeql_runner }}.
|
||||
1. Allow the CI servers access to {% data variables.product.prodname_dotcom_the_website %} so that the {% data variables.product.prodname_codeql_runner %} can download the bundle automatically.
|
||||
1. Manually download/extract the bundle, store it with other central resources, and use the `--codeql-path` flag to specify the location of the bundle in calls to initialize the {% data variables.product.prodname_codeql_runner %}.
|
||||
{% if currentVersion != "free-pro-team@latest" %}
|
||||
1. You can mirror the `github/codeql-action` repository on {{ site.data.variables.product.product_location }}. Unless you specify the <nobr>`--codeql-path`</nobr> flag, the runner automatically checks for the bundle in this location and on {{ site.data.variables.product.prodname_dotcom_the_website }}.{% endif %}
|
||||
1. You can mirror the `github/codeql-action` repository on {% data variables.product.product_location %}. Unless you specify the <nobr>`--codeql-path`</nobr> flag, the runner automatically checks for the bundle in this location and on {% data variables.product.prodname_dotcom_the_website %}.{% endif %}
|
||||
|
||||
### Calling the {{ site.data.variables.product.prodname_codeql_runner }}
|
||||
### Calling the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
You should call the {{ site.data.variables.product.prodname_codeql_runner }} from the checkout location of the repository you want to analyze. The two main commands are:
|
||||
You should call the {% data variables.product.prodname_codeql_runner %} from the checkout location of the repository you want to analyze. The two main commands are:
|
||||
|
||||
1. `init` required to initialize the runner and create a {{ site.data.variables.product.prodname_codeql }} database for each language to be analyzed. These databases are populated and analyzed by subsequent commands.
|
||||
1. `analyze` required to populate the {{ site.data.variables.product.prodname_codeql }} databases, analyze them, and upload results to {{ site.data.variables.product.product_location }}.
|
||||
1. `init` required to initialize the runner and create a {% data variables.product.prodname_codeql %} database for each language to be analyzed. These databases are populated and analyzed by subsequent commands.
|
||||
1. `analyze` required to populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload results to {% data variables.product.product_location %}.
|
||||
|
||||
For both commands, you must specify the URL of {{ site.data.variables.product.product_location }}, the repository *OWNER/NAME*, and the GitHub Apps or personal access token to use for authentication. You also need to specify the location of the CodeQL bundle unless the CI server has access to download it directly from the `github/codeql-action` repository on {{ site.data.variables.product.prodname_dotcom_the_website}}{% if currentVersion != "free-pro-team@latest" %} or mirrored on {{ site.data.variables.product.product_location }}{% endif %}.
|
||||
For both commands, you must specify the URL of {% data variables.product.product_location %}, the repository *OWNER/NAME*, and the GitHub Apps or personal access token to use for authentication. You also need to specify the location of the CodeQL bundle unless the CI server has access to download it directly from the `github/codeql-action` repository on {% data variables.product.prodname_dotcom_the_website %}{% if currentVersion != "free-pro-team@latest" %} or mirrored on {% data variables.product.product_location %}{% endif %}.
|
||||
|
||||
You can configure where the {{ site.data.variables.product.prodname_codeql_runner }} stores the CodeQL bundle for future analysis on a server using the <nobr>`--tools-dir`</nobr> flag and where it stores temporary files during analysis using <nobr>`--temp-dir`</nobr>.
|
||||
You can configure where the {% data variables.product.prodname_codeql_runner %} stores the CodeQL bundle for future analysis on a server using the <nobr>`--tools-dir`</nobr> flag and where it stores temporary files during analysis using <nobr>`--temp-dir`</nobr>.
|
||||
|
||||
To view the command-line reference for the runner, use the `-h` flag. For example, to list all commands run: `codeql-runner-OS -h`, or to list all the flags available for the `init` command run: `codeql-runner-OS init -h` (where `OS` varies according to the executable that you are using). For more information, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system#codeql-runner-command-reference)."
|
||||
To view the command-line reference for the runner, use the `-h` flag. For example, to list all commands run: `codeql-runner-OS -h`, or to list all the flags available for the `init` command run: `codeql-runner-OS init -h` (where `OS` varies according to the executable that you are using). For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system#codeql-runner-command-reference)."
|
||||
|
||||
#### Basic example
|
||||
|
||||
This example runs {{ site.data.variables.product.prodname_codeql }} analysis on a Linux CI server for the `octo-org/example-repo` repository hosted on `{{ site.data.variables.command_line.git_url_example }}`. The process is very simple because the repository contains only languages that can be analyzed by {{ site.data.variables.product.prodname_codeql }} directly, without being built (that is, Go, JavaScript, Python, and TypeScript).
|
||||
This example runs {% data variables.product.prodname_codeql %} analysis on a Linux CI server for the `octo-org/example-repo` repository hosted on `{% data variables.command_line.git_url_example %}`. The process is very simple because the repository contains only languages that can be analyzed by {% data variables.product.prodname_codeql %} directly, without being built (that is, Go, JavaScript, Python, and TypeScript).
|
||||
|
||||
1. Check out the repository to analyze.
|
||||
1. Move into the directory where the repository is checked out.
|
||||
1. Initialize the {{ site.data.variables.product.prodname_codeql_runner }} and create {{ site.data.variables.product.prodname_codeql }} databases for the languages detected.
|
||||
1. Initialize the {% data variables.product.prodname_codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected.
|
||||
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo
|
||||
--github-url {{ site.data.variables.command_line.git_url_example }} --github-auth TOKEN
|
||||
--github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN
|
||||
> Cleaning temp directory /srv/checkout/example-repo/codeql-runner
|
||||
> ...
|
||||
> Created CodeQL database at /srv/checkout/example-repo/codeql-runner/codeql_databases/javascript.
|
||||
```
|
||||
|
||||
1. Populate the {{ site.data.variables.product.prodname_codeql_runner }} databases, analyze them, and upload the results to {{ site.data.variables.product.product_name }}.
|
||||
1. Populate the {% data variables.product.prodname_codeql_runner %} databases, analyze them, and upload the results to {% data variables.product.product_name %}.
|
||||
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo
|
||||
--github-url {{ site.data.variables.command_line.git_url_example }} --github-auth TOKEN
|
||||
--github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN
|
||||
--commit 5b6a3078b31dc346e5ce7b86837d6abbe7a18bbd --ref refs/heads/main
|
||||
> Finalizing database creation
|
||||
> ...
|
||||
@@ -93,19 +93,19 @@ This example runs {{ site.data.variables.product.prodname_codeql }} analysis on
|
||||
> Successfully uploaded results
|
||||
```
|
||||
|
||||
The server has access to download the {{ site.data.variables.product.prodname_codeql }} bundle directly from the `github/codeql-action` repository on {{ site.data.variables.product.prodname_dotcom_the_website}}{% if currentVersion != "free-pro-team@latest" %} or mirrored on {{ site.data.variables.product.product_location }}{% endif %}, so there is no need to use the `--codeql-path` flag. When the analysis is complete, the {{ site.data.variables.product.prodname_codeql_runner }} uploads the results to the {{ site.data.variables.product.prodname_code_scanning }} view. For more information, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
The server has access to download the {% data variables.product.prodname_codeql %} bundle directly from the `github/codeql-action` repository on {% data variables.product.prodname_dotcom_the_website %}{% if currentVersion != "free-pro-team@latest" %} or mirrored on {% data variables.product.product_location %}{% endif %}, so there is no need to use the `--codeql-path` flag. When the analysis is complete, the {% data variables.product.prodname_codeql_runner %} uploads the results to the {% data variables.product.prodname_code_scanning %} view. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
#### Compiled language example
|
||||
|
||||
This example is similar to the previous example, however this time the repository has code in C/C++, C#, or Java. To create a {{ site.data.variables.product.prodname_codeql }} database for these languages, the CLI needs to monitor the build. At the end of the initialization process, the runner reports the command you need to set up the environment before building the code. You need to run this command, before calling the normal CI build process, and then running the `analyze` command.
|
||||
This example is similar to the previous example, however this time the repository has code in C/C++, C#, or Java. To create a {% data variables.product.prodname_codeql %} database for these languages, the CLI needs to monitor the build. At the end of the initialization process, the runner reports the command you need to set up the environment before building the code. You need to run this command, before calling the normal CI build process, and then running the `analyze` command.
|
||||
|
||||
1. Check out the repository to analyze.
|
||||
1. Move into the directory where the repository is checked out.
|
||||
1. Initialize the {{ site.data.variables.product.prodname_codeql_runner }} and create {{ site.data.variables.product.prodname_codeql }} databases for the languages detected.
|
||||
1. Initialize the {% data variables.product.prodname_codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected.
|
||||
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo-2
|
||||
--github-url {{ site.data.variables.command_line.git_url_example }} --github-auth TOKEN
|
||||
--github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN
|
||||
> Cleaning temp directory /srv/checkout/example-repo-2/codeql-runner
|
||||
> ...
|
||||
> CodeQL environment output to "/srv/checkout/example-repo-2/codeql-runner/codeql-env.json"
|
||||
@@ -121,11 +121,11 @@ This example is similar to the previous example, however this time the repositor
|
||||
```
|
||||
|
||||
1. Build the code.
|
||||
1. Populate the {{ site.data.variables.product.prodname_codeql }} databases, analyze them, and upload the results to GitHub.
|
||||
1. Populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload the results to GitHub.
|
||||
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo-2
|
||||
--github-url {{ site.data.variables.command_line.git_url_example }} --github-auth TOKEN
|
||||
--github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN
|
||||
--commit ae7b655ef30b50fb726ae7b3daa79571a39d194d --ref refs/heads/main
|
||||
> Finalizing database creation
|
||||
> ...
|
||||
@@ -135,11 +135,11 @@ This example is similar to the previous example, however this time the repositor
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** If you use a containerized build, you need to run the {{ site.data.variables.product.prodname_codeql_runner }} in the container where your build task takes place.
|
||||
**Note:** If you use a containerized build, you need to run the {% data variables.product.prodname_codeql_runner %} in the container where your build task takes place.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Configuring {{ site.data.variables.product.prodname_code_scanning }} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)"
|
||||
- "[Troubleshooting {{ site.data.variables.product.prodname_code_scanning }} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system)"
|
||||
- "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system)"
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
title: SARIF support for code scanning
|
||||
shortTitle: SARIF support
|
||||
intro: 'To display results from a third-party static analysis tool in your repository on {{ site.data.variables.product.prodname_dotcom }}, you''ll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for code scanning. If you use the default {{ site.data.variables.product.prodname_codeql }} static analysis engine, then your results will display in your repository on {{ site.data.variables.product.prodname_dotcom }} automatically.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: 'To display results from a third-party static analysis tool in your repository on {% data variables.product.prodname_dotcom %}, you''ll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for code scanning. If you use the default {% data variables.product.prodname_codeql %} static analysis engine, then your results will display in your repository on {% data variables.product.prodname_dotcom %} automatically.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/about-sarif-support-for-code-scanning
|
||||
versions:
|
||||
@@ -10,28 +10,28 @@ versions:
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### About SARIF support
|
||||
|
||||
SARIF (Static Analysis Results Interchange Format) is an [OASIS Standard](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) that defines an output file format. The SARIF standard is used to streamline how static analysis tools share their results. {{ site.data.variables.product.prodname_code_scanning_capc }} supports a subset of the SARIF 2.1.0 JSON schema.
|
||||
SARIF (Static Analysis Results Interchange Format) is an [OASIS Standard](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) that defines an output file format. The SARIF standard is used to streamline how static analysis tools share their results. {% data variables.product.prodname_code_scanning_capc %} supports a subset of the SARIF 2.1.0 JSON schema.
|
||||
|
||||
To upload a SARIF file from a third-party static code analysis engine, you'll need to ensure that uploaded files use the SARIF 2.1.0 version. {{ site.data.variables.product.prodname_dotcom }} will parse the SARIF file and show alerts using the results in your repository as a part of the code scanning experience. For more information, see "[Uploading a SARIF file to {{ site.data.variables.product.prodname_dotcom }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)." For more information about the SARIF 2.1.0 JSON schema, see [`sarif-schema-2.1.0.json`](https://github.com/oasis-tcs/sarif-spec/blob/master/Schemata/sarif-schema-2.1.0.json).
|
||||
To upload a SARIF file from a third-party static code analysis engine, you'll need to ensure that uploaded files use the SARIF 2.1.0 version. {% data variables.product.prodname_dotcom %} will parse the SARIF file and show alerts using the results in your repository as a part of the code scanning experience. For more information, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)." For more information about the SARIF 2.1.0 JSON schema, see [`sarif-schema-2.1.0.json`](https://github.com/oasis-tcs/sarif-spec/blob/master/Schemata/sarif-schema-2.1.0.json).
|
||||
|
||||
If you're using {{ site.data.variables.product.prodname_actions}} with the {{ site.data.variables.product.prodname_codeql_workflow }} or using the {{ site.data.variables.product.prodname_codeql_runner }}, then the {{ site.data.variables.product.prodname_code_scanning }} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Enabling {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning)" or "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
If you're using {% data variables.product.prodname_actions %} with the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning)" or "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
|
||||
{{ site.data.variables.product.prodname_dotcom }} uses properties in the SARIF file to display alerts. For example, the `shortDescription` and `fullDescription` appear at the top of a {{ site.data.variables.product.prodname_code_scanning }} alert. The `location` allows {{ site.data.variables.product.prodname_dotcom }} to show annotations in your code file. For more information, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
{% data variables.product.prodname_dotcom %} uses properties in the SARIF file to display alerts. For example, the `shortDescription` and `fullDescription` appear at the top of a {% data variables.product.prodname_code_scanning %} alert. The `location` allows {% data variables.product.prodname_dotcom %} to show annotations in your code file. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
If you're new to SARIF and want to learn more, see Microsoft's [`SARIF tutorials`](https://github.com/microsoft/sarif-tutorials) repository.
|
||||
|
||||
### Preventing duplicate alerts using fingerprints
|
||||
|
||||
Each time the results of a new code scan are uploaded, the results are processed and alerts are added to the repository. To prevent duplicate alerts for the same problem, {{ site.data.variables.product.prodname_code_scanning }} uses fingerprints to match results across various runs so they only appear once in the latest run for the selected branch. This makes it possible to match alerts to the right line of code when files are edited.
|
||||
Each time the results of a new code scan are uploaded, the results are processed and alerts are added to the repository. To prevent duplicate alerts for the same problem, {% data variables.product.prodname_code_scanning %} uses fingerprints to match results across various runs so they only appear once in the latest run for the selected branch. This makes it possible to match alerts to the right line of code when files are edited.
|
||||
|
||||
{{ site.data.variables.product.prodname_dotcom }} uses the `partialFingerprints` property in the OASIS standard to detect when two results are logically identical. For more information, see the "[partialFingerprints property](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012611)" entry in the OASIS documentation.
|
||||
{% data variables.product.prodname_dotcom %} uses the `partialFingerprints` property in the OASIS standard to detect when two results are logically identical. For more information, see the "[partialFingerprints property](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012611)" entry in the OASIS documentation.
|
||||
|
||||
SARIF files created by the {{ site.data.variables.product.prodname_codeql_workflow }} or using the {{ site.data.variables.product.prodname_codeql_runner }} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {{ site.data.variables.product.prodname_dotcom }} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see "[Uploading a SARIF file to {{ site.data.variables.product.prodname_dotcom }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions)."
|
||||
SARIF files created by the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {% data variables.product.prodname_dotcom %} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions)."
|
||||
|
||||
If you upload a SARIF file without fingerprint data using the `/code-scanning/sarifs` API endpoint, the code scanning alerts will be processed and displayed, but users may see duplicate alerts. To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the `partialFingerprints` property before you upload the SARIF file. You may find the script that the `upload-sarif` action uses a helpful starting point: https://github.com/github/codeql-action/blob/main/src/fingerprints.ts. For more information about the API, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)."
|
||||
|
||||
@@ -41,58 +41,58 @@ You can check a SARIF file is compatible with code scanning by testing it agains
|
||||
|
||||
### Supported SARIF output file properties
|
||||
|
||||
If you use a code analysis engine other than {{ site.data.variables.product.prodname_codeql }}, you can review the supported SARIF properties to optimize how your analysis results will appear on {{ site.data.variables.product.prodname_dotcom }}.
|
||||
If you use a code analysis engine other than {% data variables.product.prodname_codeql %}, you can review the supported SARIF properties to optimize how your analysis results will appear on {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
Any valid SARIF 2.1.0 output file can be uploaded, however, {{ site.data.variables.product.prodname_code_scanning }} will only use the following supported properties.
|
||||
Any valid SARIF 2.1.0 output file can be uploaded, however, {% data variables.product.prodname_code_scanning %} will only use the following supported properties.
|
||||
|
||||
#### `sarifLog` object
|
||||
|
||||
| Name | Description |
|
||||
|----|----|
|
||||
| `$schema` | **Required.** The URI of the SARIF JSON schema for version 2.1.0. For example, `https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json`. |
|
||||
| `version` | **Required.** {{ site.data.variables.product.prodname_code_scanning_capc }} only supports SARIF version `2.1.0`.
|
||||
| `version` | **Required.** {% data variables.product.prodname_code_scanning_capc %} only supports SARIF version `2.1.0`.
|
||||
| `runs[]` | **Required.** A SARIF file contains an array of one or more runs. Each run represents a single run of an analysis tool. For more information about a `run`, see the [`run` object](#run-object).
|
||||
|
||||
#### `run` object
|
||||
|
||||
{{ site.data.variables.product.prodname_code_scanning_capc }} uses the `run` object to filter results by tool and provide information about the source of a result. The `run` object contains the `tool.driver` tool component object, which contains information about the tool that generated the results. Each `run` can only have results for one analysis tool.
|
||||
{% data variables.product.prodname_code_scanning_capc %} uses the `run` object to filter results by tool and provide information about the source of a result. The `run` object contains the `tool.driver` tool component object, which contains information about the tool that generated the results. Each `run` can only have results for one analysis tool.
|
||||
|
||||
| Name | Description |
|
||||
|----|----|
|
||||
| `tool.driver.name` | **Required.** The name of the analysis tool. {{ site.data.variables.product.prodname_code_scanning_capc }} displays the name on {{ site.data.variables.product.prodname_dotcom }} to allow you to filter results by tool. |
|
||||
| `tool.driver.version` | **Optional.** The version of the analysis tool. {{ site.data.variables.product.prodname_code_scanning_capc }} uses the version number to track when results may have changed due to a tool version change rather than a change in the code being analyzed. If the SARIF file includes the `semanticVersion` field, `version` is not used by {{ site.data.variables.product.prodname_code_scanning }}. |
|
||||
| `tool.driver.semanticVersion` | **Optional.** The version of the analysis tool, specified by the Semantic Versioning 2.0 format. {{ site.data.variables.product.prodname_code_scanning_capc }} uses the version number to track when results may have changed due to a tool version change rather than a change in the code being analyzed. If the SARIF file includes the `semanticVersion` field, `version` is not used by {{ site.data.variables.product.prodname_code_scanning }}. For more information, see "[Semantic Versioning 2.0.0](https://semver.org/)" in the Semantic Versioning documentation. |
|
||||
| `tool.driver.name` | **Required.** The name of the analysis tool. {% data variables.product.prodname_code_scanning_capc %} displays the name on {% data variables.product.prodname_dotcom %} to allow you to filter results by tool. |
|
||||
| `tool.driver.version` | **Optional.** The version of the analysis tool. {% data variables.product.prodname_code_scanning_capc %} uses the version number to track when results may have changed due to a tool version change rather than a change in the code being analyzed. If the SARIF file includes the `semanticVersion` field, `version` is not used by {% data variables.product.prodname_code_scanning %}. |
|
||||
| `tool.driver.semanticVersion` | **Optional.** The version of the analysis tool, specified by the Semantic Versioning 2.0 format. {% data variables.product.prodname_code_scanning_capc %} uses the version number to track when results may have changed due to a tool version change rather than a change in the code being analyzed. If the SARIF file includes the `semanticVersion` field, `version` is not used by {% data variables.product.prodname_code_scanning %}. For more information, see "[Semantic Versioning 2.0.0](https://semver.org/)" in the Semantic Versioning documentation. |
|
||||
| `tool.driver.rules[]` | **Required.** An array of `reportingDescriptor` objects that represent rules. The analysis tool uses rules to find problems in the code being analyzed. For more information, see the [`reportingDescriptor` object](#reportingdescriptor-object). |
|
||||
| `results[]` | **Required.** The results of the analysis tool. {{ site.data.variables.product.prodname_code_scanning_capc }} displays the results on {{ site.data.variables.product.prodname_dotcom }}. For more information, see the [`result` object](#result-object).
|
||||
| `results[]` | **Required.** The results of the analysis tool. {% data variables.product.prodname_code_scanning_capc %} displays the results on {% data variables.product.prodname_dotcom %}. For more information, see the [`result` object](#result-object).
|
||||
|
||||
#### `reportingDescriptor` object
|
||||
|
||||
| Name | Description |
|
||||
|----|----|
|
||||
| `id` | **Required.** A unique identifier for the rule. The `id` is referenced from other parts of the SARIF file and may be used by {{ site.data.variables.product.prodname_code_scanning }} to display URLs on {{ site.data.variables.product.prodname_dotcom }}. |
|
||||
| `name` | **Optional.** The name of the rule. {{ site.data.variables.product.prodname_code_scanning_capc }} displays the name to allow results to be filtered by rule on {{ site.data.variables.product.prodname_dotcom }}. |
|
||||
| `shortDescription.text` | **Required.** A concise description of the rule. {{ site.data.variables.product.prodname_code_scanning_capc }} displays the short description on {{ site.data.variables.product.prodname_dotcom }} next to the associated results.
|
||||
| `fullDescription.text` | **Required.** A description of the rule. {{ site.data.variables.product.prodname_code_scanning_capc }} displays the full description on {{ site.data.variables.product.prodname_dotcom }} next to the associated results. The max number of characters is limited to 1000.
|
||||
| `defaultConfiguration.level` | **Optional.** Default severity level of the rule. {{ site.data.variables.product.prodname_code_scanning_capc }} uses severity levels to help you understand how critical the result is for a given rule. This value can be overridden by the `level` attribute in the `result` object. For more information, see the [`result` object](#result-object). Default: `warning`.
|
||||
| `help.text` | **Required.** Documentation for the rule using text format. {{ site.data.variables.product.prodname_code_scanning_capc }} displays this help documentation next to the associated results.
|
||||
| `help.markdown` | **Recommended.** Documentation for the rule using Markdown format. {{ site.data.variables.product.prodname_code_scanning_capc }} displays this help documentation next to the associated results. When `help.markdown` is available, it is displayed instead of `help.text`.
|
||||
| `properties.tags[]` | **Optional.** An array of strings. {{ site.data.variables.product.prodname_code_scanning_capc }} uses `tags` to allow you to filter results on {{ site.data.variables.product.prodname_dotcom }}. For example, it is possible to filter to all results that have the tag `security`.
|
||||
| `properties.precision` | **Recommended.** A string that indicates how often the results indicated by this rule are true. For example, if a rule has a known high false-positive rate, the precision should be `low`. {{ site.data.variables.product.prodname_code_scanning_capc }} orders results by precision on {{ site.data.variables.product.prodname_dotcom }} so that the results with the highest `level`, and highest `precision` are shown first. Can be one of: `very-high`, `high`, `medium`, or `low`.
|
||||
| `id` | **Required.** A unique identifier for the rule. The `id` is referenced from other parts of the SARIF file and may be used by {% data variables.product.prodname_code_scanning %} to display URLs on {% data variables.product.prodname_dotcom %}. |
|
||||
| `name` | **Optional.** The name of the rule. {% data variables.product.prodname_code_scanning_capc %} displays the name to allow results to be filtered by rule on {% data variables.product.prodname_dotcom %}. |
|
||||
| `shortDescription.text` | **Required.** A concise description of the rule. {% data variables.product.prodname_code_scanning_capc %} displays the short description on {% data variables.product.prodname_dotcom %} next to the associated results.
|
||||
| `fullDescription.text` | **Required.** A description of the rule. {% data variables.product.prodname_code_scanning_capc %} displays the full description on {% data variables.product.prodname_dotcom %} next to the associated results. The max number of characters is limited to 1000.
|
||||
| `defaultConfiguration.level` | **Optional.** Default severity level of the rule. {% data variables.product.prodname_code_scanning_capc %} uses severity levels to help you understand how critical the result is for a given rule. This value can be overridden by the `level` attribute in the `result` object. For more information, see the [`result` object](#result-object). Default: `warning`.
|
||||
| `help.text` | **Required.** Documentation for the rule using text format. {% data variables.product.prodname_code_scanning_capc %} displays this help documentation next to the associated results.
|
||||
| `help.markdown` | **Recommended.** Documentation for the rule using Markdown format. {% data variables.product.prodname_code_scanning_capc %} displays this help documentation next to the associated results. When `help.markdown` is available, it is displayed instead of `help.text`.
|
||||
| `properties.tags[]` | **Optional.** An array of strings. {% data variables.product.prodname_code_scanning_capc %} uses `tags` to allow you to filter results on {% data variables.product.prodname_dotcom %}. For example, it is possible to filter to all results that have the tag `security`.
|
||||
| `properties.precision` | **Recommended.** A string that indicates how often the results indicated by this rule are true. For example, if a rule has a known high false-positive rate, the precision should be `low`. {% data variables.product.prodname_code_scanning_capc %} orders results by precision on {% data variables.product.prodname_dotcom %} so that the results with the highest `level`, and highest `precision` are shown first. Can be one of: `very-high`, `high`, `medium`, or `low`.
|
||||
|
||||
#### `result` object
|
||||
|
||||
| Name | Description |
|
||||
|----|----|
|
||||
| `ruleId`| **Optional.** The unique identifier of the rule (`reportingDescriptor.id`). For more information, see the [`reportingDescriptor` object](#reportingdescriptor-object). {{ site.data.variables.product.prodname_code_scanning_capc }} uses the rule identifier to filter results by rule on {{ site.data.variables.product.prodname_dotcom }}.
|
||||
| `ruleId`| **Optional.** The unique identifier of the rule (`reportingDescriptor.id`). For more information, see the [`reportingDescriptor` object](#reportingdescriptor-object). {% data variables.product.prodname_code_scanning_capc %} uses the rule identifier to filter results by rule on {% data variables.product.prodname_dotcom %}.
|
||||
| `ruleIndex`| **Optional.** The index of the associated rule (`reportingDescriptor` object) in the tool component `rules` array. For more information, see the [`run` object](#run-object).
|
||||
| `rule`| **Optional.** A reference used to locate the rule (reporting descriptor) for this result. For more information, see the [`reportingDescriptor` object](#reportingdescriptor-object).
|
||||
| `level`| **Optional.** The severity of the result. This level overrides the default severity defined by the rule. {{ site.data.variables.product.prodname_code_scanning_capc }} uses the level to filter results by severity on {{ site.data.variables.product.prodname_dotcom }}.
|
||||
| `message.text`| **Required.** A message that describes the result. {{ site.data.variables.product.prodname_code_scanning_capc }} displays the message text as the title of the result. Only the first sentence of the message will be displayed when visible space is limited.
|
||||
| `locations[]`| **Required.** The set of locations where the result was detected. Only one location should be included unless the problem can only be corrected by making a change at every specified location. **Note:** At least one location is required for {{ site.data.variables.product.prodname_code_scanning }} to display a result. {{ site.data.variables.product.prodname_code_scanning_capc }} will use this property to decide which file to annotate with the result. Only the first value of this array is used. All other values are ignored.
|
||||
| `partialFingerprints`| **Required.** A set of strings used to track the unique identity of the result. {{ site.data.variables.product.prodname_code_scanning_capc }} uses `partialFingerprints` to accurately identify which results are the same across commits and branches. {{ site.data.variables.product.prodname_code_scanning_capc }} will attempt to use `partialFingerprints` if they exist. If you are uploading third-party SARIF files with the `upload-action`, the action will create `partialFingerprints` for you when they are not included in the SARIF file. For more information, see "[Preventing duplicate alerts using fingerprints](#preventing-duplicate-alerts-using-fingerprints)." **Note:** {{ site.data.variables.product.prodname_code_scanning_capc }} only uses the `primaryLocationLineHash`.
|
||||
| `codeFlows[].threadFlows[].locations[]`| **Optional.** An array of `location` objects for a `threadFlow` object, which describes the progress of a program through a thread of execution. A `codeFlow` object describes a pattern of code execution used to detect a result. If code flows are provided, {{ site.data.variables.product.prodname_code_scanning }} will expand code flows on {{ site.data.variables.product.prodname_dotcom }} for the relevant result. For more information, see the [`location` object](#location-object).
|
||||
| `relatedLocations[]`| A set of locations relevant to this result. {{ site.data.variables.product.prodname_code_scanning_capc }} will link to related locations when they are embedded in the result message. For more information, see the [`location` object](#location-object).
|
||||
| `suppressions[].state`| **Optional.** When the `state` is set to `accepted`, {{ site.data.variables.product.prodname_code_scanning }} will update the state of the result to `Closed` on {{ site.data.variables.product.prodname_dotcom }}.
|
||||
| `level`| **Optional.** The severity of the result. This level overrides the default severity defined by the rule. {% data variables.product.prodname_code_scanning_capc %} uses the level to filter results by severity on {% data variables.product.prodname_dotcom %}.
|
||||
| `message.text`| **Required.** A message that describes the result. {% data variables.product.prodname_code_scanning_capc %} displays the message text as the title of the result. Only the first sentence of the message will be displayed when visible space is limited.
|
||||
| `locations[]`| **Required.** The set of locations where the result was detected. Only one location should be included unless the problem can only be corrected by making a change at every specified location. **Note:** At least one location is required for {% data variables.product.prodname_code_scanning %} to display a result. {% data variables.product.prodname_code_scanning_capc %} will use this property to decide which file to annotate with the result. Only the first value of this array is used. All other values are ignored.
|
||||
| `partialFingerprints`| **Required.** A set of strings used to track the unique identity of the result. {% data variables.product.prodname_code_scanning_capc %} uses `partialFingerprints` to accurately identify which results are the same across commits and branches. {% data variables.product.prodname_code_scanning_capc %} will attempt to use `partialFingerprints` if they exist. If you are uploading third-party SARIF files with the `upload-action`, the action will create `partialFingerprints` for you when they are not included in the SARIF file. For more information, see "[Preventing duplicate alerts using fingerprints](#preventing-duplicate-alerts-using-fingerprints)." **Note:** {% data variables.product.prodname_code_scanning_capc %} only uses the `primaryLocationLineHash`.
|
||||
| `codeFlows[].threadFlows[].locations[]`| **Optional.** An array of `location` objects for a `threadFlow` object, which describes the progress of a program through a thread of execution. A `codeFlow` object describes a pattern of code execution used to detect a result. If code flows are provided, {% data variables.product.prodname_code_scanning %} will expand code flows on {% data variables.product.prodname_dotcom %} for the relevant result. For more information, see the [`location` object](#location-object).
|
||||
| `relatedLocations[]`| A set of locations relevant to this result. {% data variables.product.prodname_code_scanning_capc %} will link to related locations when they are embedded in the result message. For more information, see the [`location` object](#location-object).
|
||||
| `suppressions[].state`| **Optional.** When the `state` is set to `accepted`, {% data variables.product.prodname_code_scanning %} will update the state of the result to `Closed` on {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
#### `location` object
|
||||
|
||||
@@ -108,7 +108,7 @@ A location within a programming artifact, such as a file in the repository or a
|
||||
|
||||
| Name | Description |
|
||||
|----|----|
|
||||
| `artifactLocation.uri`| **Required.** A URI indicating the location of an artifact, usually a file either in the repository or generated during a build. If the URI is relative, it should be relative to the root of the {{ site.data.variables.product.prodname_dotcom }} repository being analyzed. For example, main.js or src/script.js are relative to the root of the repository. If the URI is absolute, {{ site.data.variables.product.prodname_code_scanning }} can use the URI to checkout the artifact and match up files in the repository. For example, `https://github.com/github/example/blob/00/src/promiseUtils.js`.
|
||||
| `artifactLocation.uri`| **Required.** A URI indicating the location of an artifact, usually a file either in the repository or generated during a build. If the URI is relative, it should be relative to the root of the {% data variables.product.prodname_dotcom %} repository being analyzed. For example, main.js or src/script.js are relative to the root of the repository. If the URI is absolute, {% data variables.product.prodname_code_scanning %} can use the URI to checkout the artifact and match up files in the repository. For example, `https://github.com/github/example/blob/00/src/promiseUtils.js`.
|
||||
| `region.startLine` | **Required.** The line number of the first character in the region.
|
||||
| `region.startColumn` | **Required.** The column number of the first character in the region.
|
||||
| `region.endLine` | **Required.** The line number of the last character in the region.
|
||||
@@ -120,7 +120,7 @@ These example SARIF output files show supported properties and example values.
|
||||
|
||||
#### Example with minimum required properties
|
||||
|
||||
This SARIF output file has example values to show the minimum required properties for {{ site.data.variables.product.prodname_code_scanning }} results to work as expected. If you remove any properties or don't include values, this data will not be displayed correctly or sync on {{ site.data.variables.product.prodname_dotcom }}.
|
||||
This SARIF output file has example values to show the minimum required properties for {% data variables.product.prodname_code_scanning %} results to work as expected. If you remove any properties or don't include values, this data will not be displayed correctly or sync on {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
|
||||
```json
|
||||
@@ -171,7 +171,7 @@ This SARIF output file has example values to show the minimum required propertie
|
||||
|
||||
#### Example showing all supported SARIF properties
|
||||
|
||||
This SARIF output file has example values to show all supported SARIF properties for {{ site.data.variables.product.prodname_code_scanning }}.
|
||||
This SARIF output file has example values to show all supported SARIF properties for {% data variables.product.prodname_code_scanning %}.
|
||||
|
||||
```json
|
||||
{
|
||||
|
||||
@@ -1,49 +1,49 @@
|
||||
---
|
||||
title: Triaging code scanning alerts in pull requests
|
||||
shortTitle: Triaging alerts in pull requests
|
||||
intro: 'When {{ site.data.variables.product.prodname_code_scanning }} identifies a problem in a pull request, you can review the highlighted code and resolve the alert.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
permissions: 'People with write permission to a repository can resolve {{ site.data.variables.product.prodname_code_scanning }} alerts.'
|
||||
intro: 'When {% data variables.product.prodname_code_scanning %} identifies a problem in a pull request, you can review the highlighted code and resolve the alert.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'People with write permission to a repository can resolve {% data variables.product.prodname_code_scanning %} alerts.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning-actions }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
||||
### About {{ site.data.variables.product.prodname_code_scanning }} results on pull requests
|
||||
### About {% data variables.product.prodname_code_scanning %} results on pull requests
|
||||
|
||||
In repositories where {{ site.data.variables.product.prodname_code_scanning }} is configured as a pull request check, {{ site.data.variables.product.prodname_code_scanning }} checks the code in the pull request. By default, this is limited to pull requests that target the default branch or protected branches, but you can change this configuration within {{ site.data.variables.product.prodname_actions }} or in a third-party CI/CD system. If merging the changes would introduce new {{ site.data.variables.product.prodname_code_scanning }} alerts to the target branch, these are reported as check results in the pull request. The alerts are also shown as annotations in the **Files changed** tab of the pull request. If you have write permission for the repository, you can see any existing {{ site.data.variables.product.prodname_code_scanning }} alerts on the **Security** tab. For information about repository alerts, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
In repositories where {% data variables.product.prodname_code_scanning %} is configured as a pull request check, {% data variables.product.prodname_code_scanning %} checks the code in the pull request. By default, this is limited to pull requests that target the default branch or protected branches, but you can change this configuration within {% data variables.product.prodname_actions %} or in a third-party CI/CD system. If merging the changes would introduce new {% data variables.product.prodname_code_scanning %} alerts to the target branch, these are reported as check results in the pull request. The alerts are also shown as annotations in the **Files changed** tab of the pull request. If you have write permission for the repository, you can see any existing {% data variables.product.prodname_code_scanning %} alerts on the **Security** tab. For information about repository alerts, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
If {{ site.data.variables.product.prodname_code_scanning }} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {{ site.data.variables.product.prodname_code_scanning }} have lower severities, the alerts are treated as warnings or notices and the check succeeds. If your pull request targets a protected branch, and the repository owner has configured required status checks, then you must either fix or close any error alerts before the pull request can be merged. For more information, see "[About required status checks](/github/administering-a-repository/about-required-status-checks)."
|
||||
If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds. If your pull request targets a protected branch, and the repository owner has configured required status checks, then you must either fix or close any error alerts before the pull request can be merged. For more information, see "[About required status checks](/github/administering-a-repository/about-required-status-checks)."
|
||||
|
||||
|
||||
|
||||
|
||||
### About {{ site.data.variables.product.prodname_code_scanning }} as a pull request check
|
||||
### About {% data variables.product.prodname_code_scanning %} as a pull request check
|
||||
|
||||
There are many options for configuring {{ site.data.variables.product.prodname_code_scanning }} as a pull request check, so the exact setup of each repository will vary and some will have more than one check. The check that contains the results of {{ site.data.variables.product.prodname_code_scanning }} is: **Code scanning results**.
|
||||
There are many options for configuring {% data variables.product.prodname_code_scanning %} as a pull request check, so the exact setup of each repository will vary and some will have more than one check. The check that contains the results of {% data variables.product.prodname_code_scanning %} is: **Code scanning results**.
|
||||
|
||||
If the repository uses the {{ site.data.variables.product.prodname_codeql_workflow }} a **{{ site.data.variables.product.prodname_codeql }} / Analyze (LANGUAGE)** check is run for each language before the results check runs. The analysis check may fail if there are configuration problems, or if the pull request breaks the build for a language that the analysis needs to compile (for example, C/C++, C#, or Java). As with other pull request checks, you can see full details of the check failure on the **Checks** tab. For more information about configuring and troubleshooting, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)" or "[Troubleshooting {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning)."
|
||||
If the repository uses the {% data variables.product.prodname_codeql_workflow %} a **{% data variables.product.prodname_codeql %} / Analyze (LANGUAGE)** check is run for each language before the results check runs. The analysis check may fail if there are configuration problems, or if the pull request breaks the build for a language that the analysis needs to compile (for example, C/C++, C#, or Java). As with other pull request checks, you can see full details of the check failure on the **Checks** tab. For more information about configuring and troubleshooting, see "[Configuring {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning)" or "[Troubleshooting {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning)."
|
||||
|
||||
### Triaging an alert on your pull request
|
||||
|
||||
When you look at the **Files changed** tab for a pull request, you see annotations for any lines of code that triggered the alert.
|
||||
|
||||
|
||||
|
||||
|
||||
Some annotations contain links with extra context for the alert. In the example above, from {{ site.data.variables.product.prodname_codeql }} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {{ site.data.variables.product.prodname_codeql }}, see "[About data flow analysis](https://help.semmle.com/QL/learn-ql/intro-to-data-flow.html)."
|
||||
Some annotations contain links with extra context for the alert. In the example above, from {% data variables.product.prodname_codeql %} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {% data variables.product.prodname_codeql %}, see "[About data flow analysis](https://help.semmle.com/QL/learn-ql/intro-to-data-flow.html)."
|
||||
|
||||
For more information about an alert, click **Show more details** on the annotation. This allows you to see all of the context and metadata provided by the tool in an alert view. In the example below, you can see tags showing the severity, type, and relevant common weakness enumerations (CWEs) for the problem. The view also shows which commit introduced the problem.
|
||||
|
||||
Alerts from some tools, like {{ site.data.variables.product.prodname_codeql }}, also include a description and a **Show more** link for guidance on how to fix the problem in the code.
|
||||
Alerts from some tools, like {% data variables.product.prodname_codeql %}, also include a description and a **Show more** link for guidance on how to fix the problem in the code.
|
||||
|
||||
|
||||
|
||||
|
||||
### Resolving an alert on your pull request
|
||||
|
||||
Anyone with write permission for a repository can resolve alerts on a pull request. If you commit changes to the pull request this triggers a new run of the pull request checks. If your changes fix the problem, the alert is resolved and the annotation removed.
|
||||
|
||||
If you don't think that an alert needs to be fixed, you can close the alert manually. {{ site.data.reusables.code-scanning.close-alert-examples }} The **Close** button is available in annotations and in the alerts view if you have write permission for the repository.
|
||||
If you don't think that an alert needs to be fixed, you can close the alert manually. {% data reusables.code-scanning.close-alert-examples %} The **Close** button is available in annotations and in the alerts view if you have write permission for the repository.
|
||||
|
||||
{{ site.data.reusables.code-scanning.false-positive-fix-codeql }}
|
||||
{% data reusables.code-scanning.false-positive-fix-codeql %}
|
||||
|
||||
@@ -1,32 +1,32 @@
|
||||
---
|
||||
title: Troubleshooting code scanning in your CI system
|
||||
shortTitle: Troubleshooting in your CI
|
||||
intro: 'If you''re having problems with the {{ site.data.variables.product.prodname_codeql_runner }}, you can troubleshoot by using these tips.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: 'If you''re having problems with the {% data variables.product.prodname_codeql_runner %}, you can troubleshoot by using these tips.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### The `init` command takes too long
|
||||
|
||||
Before the {{ site.data.variables.product.prodname_codeql_runner }} can build and analyze code, it needs access to the {{ site.data.variables.product.prodname_codeql }} bundle, which contains the {{ site.data.variables.product.prodname_codeql }} CLI and the {{ site.data.variables.product.prodname_codeql }} libraries.
|
||||
Before the {% data variables.product.prodname_codeql_runner %} can build and analyze code, it needs access to the {% data variables.product.prodname_codeql %} bundle, which contains the {% data variables.product.prodname_codeql %} CLI and the {% data variables.product.prodname_codeql %} libraries.
|
||||
|
||||
When you use the {{ site.data.variables.product.prodname_codeql_runner }} for the first time on your machine, the `init` command downloads the {{ site.data.variables.product.prodname_codeql }} bundle to your machine. This download can take a few minutes.
|
||||
The {{ site.data.variables.product.prodname_codeql }} bundle is cached between runs, so if you use the {{ site.data.variables.product.prodname_codeql_runner }} again on the same machine, it won't download the {{ site.data.variables.product.prodname_codeql }} bundle again.
|
||||
When you use the {% data variables.product.prodname_codeql_runner %} for the first time on your machine, the `init` command downloads the {% data variables.product.prodname_codeql %} bundle to your machine. This download can take a few minutes.
|
||||
The {% data variables.product.prodname_codeql %} bundle is cached between runs, so if you use the {% data variables.product.prodname_codeql_runner %} again on the same machine, it won't download the {% data variables.product.prodname_codeql %} bundle again.
|
||||
|
||||
To avoid this automatic download, you can manually download the {{ site.data.variables.product.prodname_codeql }} bundle to your machine and specify the path using the `--codeql-path` flag of the `init` command.
|
||||
To avoid this automatic download, you can manually download the {% data variables.product.prodname_codeql %} bundle to your machine and specify the path using the `--codeql-path` flag of the `init` command.
|
||||
|
||||
### No code found during the build
|
||||
|
||||
If the `analyze` command for the {{ site.data.variables.product.prodname_codeql_runner }} fails with an error `No source code was seen during the build`, this indicates that {{ site.data.variables.product.prodname_codeql }} was unable to monitor your code. Several reasons can explain such a failure.
|
||||
If the `analyze` command for the {% data variables.product.prodname_codeql_runner %} fails with an error `No source code was seen during the build`, this indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code. Several reasons can explain such a failure.
|
||||
|
||||
1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by using the `--languages` flag of the `init` command. For more information, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)."
|
||||
1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by using the `--languages` flag of the `init` command. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)."
|
||||
|
||||
1. You're analyzing a compiled language without using the `autobuild` command and you run the build steps yourself after the `init` step. For the build to work, you must set up the environment such that the {{ site.data.variables.product.prodname_codeql_runner }} can monitor the code. The `init` command generates instructions for how to export the required environment variables, so you can copy and run the script after you've run the `init` command.
|
||||
1. You're analyzing a compiled language without using the `autobuild` command and you run the build steps yourself after the `init` step. For the build to work, you must set up the environment such that the {% data variables.product.prodname_codeql_runner %} can monitor the code. The `init` command generates instructions for how to export the required environment variables, so you can copy and run the script after you've run the `init` command.
|
||||
- On macOS and Linux:
|
||||
```shell
|
||||
$ . codeql-runner/codeql-env.sh
|
||||
@@ -48,4 +48,4 @@ If the `analyze` command for the {{ site.data.variables.product.prodname_codeql_
|
||||
|
||||
{% endnote %}
|
||||
|
||||
1. The code is built in a container or on a separate machine. If you use a containerized build or if you outsource the build to another machine, make sure to run the {{ site.data.variables.product.prodname_codeql_runner }} in the container or on the machine where your build task takes place.
|
||||
1. The code is built in a container or on a separate machine. If you use a containerized build or if you outsource the build to another machine, make sure to run the {% data variables.product.prodname_codeql_runner %} in the container or on the machine where your build task takes place.
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Troubleshooting the CodeQL workflow
|
||||
shortTitle: Troubleshooting CodeQL
|
||||
intro: 'If you''re having problems with {{ site.data.variables.product.prodname_code_scanning }}, you can troubleshoot by using these tips for resolving issues.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: 'If you''re having problems with {% data variables.product.prodname_code_scanning %}, you can troubleshoot by using these tips for resolving issues.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning
|
||||
versions:
|
||||
@@ -10,18 +10,18 @@ versions:
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning-actions }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
||||
### Automatic build for a compiled language fails
|
||||
|
||||
If an automatic build of code for a compiled language within your project fails, try the following troubleshooting steps.
|
||||
|
||||
- Remove the `autobuild` step from your {{ site.data.variables.product.prodname_code_scanning }} workflow and add specific build steps. For information about editing the workflow, see "[Configuring {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#editing-a-code-scanning-workflow)." For more information about replacing the `autobuild` step, see "[Configuring the {{ site.data.variables.product.prodname_codeql }} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
- Remove the `autobuild` step from your {% data variables.product.prodname_code_scanning %} workflow and add specific build steps. For information about editing the workflow, see "[Configuring {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#editing-a-code-scanning-workflow)." For more information about replacing the `autobuild` step, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
|
||||
- If your workflow doesn't explicitly specify the languages to analyze, {{ site.data.variables.product.prodname_codeql }} implicitly detects the supported languages in your code base. In this configuration, out of the compiled languages C/C++, C#, and Java, {{ site.data.variables.product.prodname_codeql }} only analyzes the language with the most source files. Edit the workflow and add a build matrix specifying the languages you want to analyze. The default CodeQL analysis workflow uses such a matrix.
|
||||
- If your workflow doesn't explicitly specify the languages to analyze, {% data variables.product.prodname_codeql %} implicitly detects the supported languages in your code base. In this configuration, out of the compiled languages C/C++, C#, and Java, {% data variables.product.prodname_codeql %} only analyzes the language with the most source files. Edit the workflow and add a build matrix specifying the languages you want to analyze. The default CodeQL analysis workflow uses such a matrix.
|
||||
|
||||
The following extracts from a workflow show how you can use a matrix within the job strategy to specify languages, and then reference each language within the "Initialize {{ site.data.variables.product.prodname_codeql }}" step:
|
||||
The following extracts from a workflow show how you can use a matrix within the job strategy to specify languages, and then reference each language within the "Initialize {% data variables.product.prodname_codeql %}" step:
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
@@ -34,7 +34,7 @@ If an automatic build of code for a compiled language within your project fails,
|
||||
|
||||
...
|
||||
|
||||
- name: Initialize {{ site.data.variables.product.prodname_codeql }}
|
||||
- name: Initialize {% data variables.product.prodname_codeql %}
|
||||
uses: github/codeql-action/init@v1
|
||||
with:
|
||||
languages: {% raw %}${{ matrix.language }}{% endraw %}
|
||||
@@ -44,7 +44,7 @@ If an automatic build of code for a compiled language within your project fails,
|
||||
|
||||
### No code found during the build
|
||||
|
||||
If your workflow fails with an error `No source code was seen during the build` or `The process '/opt/hostedtoolcache/CodeQL/0.0.0-20200630/x64/codeql/codeql' failed with exit code 32`, this indicates that {{ site.data.variables.product.prodname_codeql }} was unable to monitor your code. Several reasons can explain such a failure:
|
||||
If your workflow fails with an error `No source code was seen during the build` or `The process '/opt/hostedtoolcache/CodeQL/0.0.0-20200630/x64/codeql/codeql' failed with exit code 32`, this indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code. Several reasons can explain such a failure:
|
||||
|
||||
1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by updating the list of languages in the `language` matrix. For example, the following configuration will analyze only Go, and JavaScript.
|
||||
|
||||
@@ -58,10 +58,10 @@ If your workflow fails with an error `No source code was seen during the build`
|
||||
language: ['go', 'javascript']
|
||||
```
|
||||
For more information, see the workflow extract in "[Automatic build for a compiled language fails](#automatic-build-for-a-compiled-language-fails)" above.
|
||||
1. Your {{ site.data.variables.product.prodname_code_scanning }} workflow is analyzing a compiled language (C, C++, C#, or Java), but the code was not compiled. By default, the {{ site.data.variables.product.prodname_codeql }} analysis workflow contains an `autobuild` step, however, this step represents a best effort process, and may not succeed in building your code, depending on your specific build environment. Compilation may also fail if you have removed the `autobuild` step and did not include build steps manually. For more information about specifying build steps, see "[Configuring the {{ site.data.variables.product.prodname_codeql }} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
1. Your workflow is analyzing a compiled language (C, C++, C#, or Java), but portions of your build are cached to improve performance (most likely to occur with build systems like Gradle or Bazel). Since {{ site.data.variables.product.prodname_codeql }} observes the activity of the compiler to understand the data flows in a repository, {{ site.data.variables.product.prodname_codeql }} requires a complete build to take place in order to perform analysis.
|
||||
1. Your workflow is analyzing a compiled language (C, C++, C#, or Java), but compilation does not occur between the `init` and `analyze` steps in the workflow. {{ site.data.variables.product.prodname_codeql }} requires that your build happens in between these two steps in order to observe the activity of the compiler and perform analysis.
|
||||
1. Your compiled code (in C, C++, C#, or Java) was compiled successfully, but {{ site.data.variables.product.prodname_codeql }} was unable to detect the compiler invocations. The most common causes are certain configuration options like running your build process in a container, if you're building using a distributed build system external to {{ site.data.variables.product.prodname_actions }} using a daemon process, or if {{ site.data.variables.product.prodname_codeql }} isn't aware of the specific compiler you are using.
|
||||
1. Your {% data variables.product.prodname_code_scanning %} workflow is analyzing a compiled language (C, C++, C#, or Java), but the code was not compiled. By default, the {% data variables.product.prodname_codeql %} analysis workflow contains an `autobuild` step, however, this step represents a best effort process, and may not succeed in building your code, depending on your specific build environment. Compilation may also fail if you have removed the `autobuild` step and did not include build steps manually. For more information about specifying build steps, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
1. Your workflow is analyzing a compiled language (C, C++, C#, or Java), but portions of your build are cached to improve performance (most likely to occur with build systems like Gradle or Bazel). Since {% data variables.product.prodname_codeql %} observes the activity of the compiler to understand the data flows in a repository, {% data variables.product.prodname_codeql %} requires a complete build to take place in order to perform analysis.
|
||||
1. Your workflow is analyzing a compiled language (C, C++, C#, or Java), but compilation does not occur between the `init` and `analyze` steps in the workflow. {% data variables.product.prodname_codeql %} requires that your build happens in between these two steps in order to observe the activity of the compiler and perform analysis.
|
||||
1. Your compiled code (in C, C++, C#, or Java) was compiled successfully, but {% data variables.product.prodname_codeql %} was unable to detect the compiler invocations. The most common causes are certain configuration options like running your build process in a container, if you're building using a distributed build system external to {% data variables.product.prodname_actions %} using a daemon process, or if {% data variables.product.prodname_codeql %} isn't aware of the specific compiler you are using.
|
||||
|
||||
For C# projects using either `dotnet build` or `msbuild` which target .NET Core 2, you should specify `/p:UseSharedCompilation=false` in your workflow's `run` step, when you build your code. The `UseSharedCompilation` flag isn't necessary for .NET Core 3.0 and later.
|
||||
|
||||
@@ -72,45 +72,45 @@ For more information, see the workflow extract in "[Automatic build for a compil
|
||||
dotnet build /p:UseSharedCompilation=false
|
||||
```
|
||||
|
||||
If you encounter another problem with your specific compiler or configuration, contact {{ site.data.variables.contact.contact_support }}.
|
||||
If you encounter another problem with your specific compiler or configuration, contact {% data variables.contact.contact_support %}.
|
||||
|
||||
For more information about specifying build steps, see "[Configuring the {{ site.data.variables.product.prodname_codeql }} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
For more information about specifying build steps, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
|
||||
### Portions of my repository were not analyzed using `autobuild`
|
||||
|
||||
The {{ site.data.variables.product.prodname_codeql }} `autobuild` feature uses heuristics to build the code in a repository, however, sometimes this approach results in incomplete analysis of a repository. For example, when multiple `build.sh` commands exist in a single repository, the analysis may not complete since the `autobuild` step will only execute one of the commands. The solution is to replace the `autobuild` step with build steps which build all of the source code which you wish to analyze. For more information, see "[Configuring the {{ site.data.variables.product.prodname_codeql }} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
The {% data variables.product.prodname_codeql %} `autobuild` feature uses heuristics to build the code in a repository, however, sometimes this approach results in incomplete analysis of a repository. For example, when multiple `build.sh` commands exist in a single repository, the analysis may not complete since the `autobuild` step will only execute one of the commands. The solution is to replace the `autobuild` step with build steps which build all of the source code which you wish to analyze. For more information, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
|
||||
### Error: "Server error"
|
||||
|
||||
If the run of a workflow for {{ site.data.variables.product.prodname_code_scanning }} fails due to a server error, try running the workflow again. If the problem persists, contact {{ site.data.variables.contact.contact_support }}.
|
||||
If the run of a workflow for {% data variables.product.prodname_code_scanning %} fails due to a server error, try running the workflow again. If the problem persists, contact {% data variables.contact.contact_support %}.
|
||||
|
||||
### Error: "Out of disk" or "Out of memory"
|
||||
|
||||
On very large projects, {{ site.data.variables.product.prodname_codeql }} may run out of disk or memory on the runner.
|
||||
{% if currentVersion == "free-pro-team@latest" %}If you encounter this issue on a hosted {{ site.data.variables.product.prodname_actions }} runner, contact {{ site.data.variables.contact.contact_support }} so that we can investigate the problem.
|
||||
On very large projects, {% data variables.product.prodname_codeql %} may run out of disk or memory on the runner.
|
||||
{% if currentVersion == "free-pro-team@latest" %}If you encounter this issue on a hosted {% data variables.product.prodname_actions %} runner, contact {% data variables.contact.contact_support %} so that we can investigate the problem.
|
||||
{% else %}If you encounter this issue, try increasing the memory on the runner.{% endif %}
|
||||
|
||||
### The build takes too long
|
||||
|
||||
If your build with {{ site.data.variables.product.prodname_codeql }} analysis takes too long to run, there are several approaches you can try to reduce the build time.
|
||||
If your build with {% data variables.product.prodname_codeql %} analysis takes too long to run, there are several approaches you can try to reduce the build time.
|
||||
|
||||
#### Increase the memory or cores
|
||||
|
||||
If you use self-hosted runners to run {{ site.data.variables.product.prodname_codeql }} analysis, you can increase the memory or the number of cores on those runners.
|
||||
If you use self-hosted runners to run {% data variables.product.prodname_codeql %} analysis, you can increase the memory or the number of cores on those runners.
|
||||
|
||||
#### Use matrix builds to parallelize the analysis
|
||||
|
||||
The default {{ site.data.variables.product.prodname_codeql_workflow }} uses a build matrix of languages, which causes the analysis of each language to run in parallel. If you have specified the languages you want to analyze directly in the "Initialize CodeQL" step, analysis of each language will happen sequentially. To speed up analysis of multiple languages, modify your workflow to use a matrix. For more information, see the workflow extract in "[Automatic build for a compiled language fails](#automatic-build-for-a-compiled-language-fails)" above.
|
||||
The default {% data variables.product.prodname_codeql_workflow %} uses a build matrix of languages, which causes the analysis of each language to run in parallel. If you have specified the languages you want to analyze directly in the "Initialize CodeQL" step, analysis of each language will happen sequentially. To speed up analysis of multiple languages, modify your workflow to use a matrix. For more information, see the workflow extract in "[Automatic build for a compiled language fails](#automatic-build-for-a-compiled-language-fails)" above.
|
||||
|
||||
#### Reduce the amount of code being analyzed in a single workflow
|
||||
|
||||
Analysis time is typically proportional to the amount of code being analyzed. You can reduce the analysis time by reducing the amount of code being analyzed at once, for example, by excluding test code, or breaking analysis into multiple workflows that analyze only a subset of your code at a time.
|
||||
|
||||
For compiled languages like Java, C, C++, and C#, {{ site.data.variables.product.prodname_codeql }} analyzes all of the code which was built during the workflow run. To limit the amount of code being analyzed, build only the code which you wish to analyze by specifying your own build steps in a `run` block. You can combine specifying your own build steps with using the `paths` or `paths-ignore` filters on the `pull_request` and `push` events to ensure that your workflow only runs when specific code is changed. For more information, see "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpaths)."
|
||||
For compiled languages like Java, C, C++, and C#, {% data variables.product.prodname_codeql %} analyzes all of the code which was built during the workflow run. To limit the amount of code being analyzed, build only the code which you wish to analyze by specifying your own build steps in a `run` block. You can combine specifying your own build steps with using the `paths` or `paths-ignore` filters on the `pull_request` and `push` events to ensure that your workflow only runs when specific code is changed. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpaths)."
|
||||
|
||||
For interpreted languages like Go, JavaScript, Python, and TypeScript, that {{ site.data.variables.product.prodname_codeql }} analyzes without a specific build, you can specify additional configuration options to limit the amount of code to analyze. For more information, see "[Specifying directories to scan](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#specifying-directories-to-scan)."
|
||||
For interpreted languages like Go, JavaScript, Python, and TypeScript, that {% data variables.product.prodname_codeql %} analyzes without a specific build, you can specify additional configuration options to limit the amount of code to analyze. For more information, see "[Specifying directories to scan](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#specifying-directories-to-scan)."
|
||||
|
||||
If you split your analysis into multiple workflows as described above, we still recommend that you have at least one workflow which runs on a `schedule` which analyzes all of the code in your repository. Because {{ site.data.variables.product.prodname_codeql }} analyzes data flows between components, some complex security behaviors may only be detected on a complete build.
|
||||
If you split your analysis into multiple workflows as described above, we still recommend that you have at least one workflow which runs on a `schedule` which analyzes all of the code in your repository. Because {% data variables.product.prodname_codeql %} analyzes data flows between components, some complex security behaviors may only be detected on a complete build.
|
||||
|
||||
#### Run only during a `schedule` event
|
||||
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
title: Uploading a SARIF file to GitHub
|
||||
shortTitle: Uploading a SARIF file
|
||||
intro: '{{ site.data.reusables.code-scanning.you-can-upload-third-party-analysis }}'
|
||||
permissions: 'People with write permissions to a repository can upload {{ site.data.variables.product.prodname_code_scanning }} data generated outside {{ site.data.variables.product.prodname_dotcom }}.'
|
||||
product: '{{ site.data.reusables.gated-features.code-scanning }}'
|
||||
intro: '{% data reusables.code-scanning.you-can-upload-third-party-analysis %}'
|
||||
permissions: 'People with write permissions to a repository can upload {% data variables.product.prodname_code_scanning %} data generated outside {% data variables.product.prodname_dotcom %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/uploading-a-code-scanning-analysis-to-github
|
||||
versions:
|
||||
@@ -11,31 +11,31 @@ versions:
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
{{ site.data.reusables.code-scanning.beta }}
|
||||
{{ site.data.reusables.code-scanning.enterprise-enable-code-scanning }}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### About SARIF file uploads for {{ site.data.variables.product.prodname_code_scanning }}
|
||||
### About SARIF file uploads for {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
{{ site.data.variables.product.prodname_dotcom }} creates {{ site.data.variables.product.prodname_code_scanning }} alerts in a repository using information from Static Analysis Results Interchange Format (SARIF) files. SARIF files can be uploaded to a repository using the API or {{ site.data.variables.product.prodname_actions }}. For more information, see "[Managing {{ site.data.variables.product.prodname_code_scanning }} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
{% data variables.product.prodname_dotcom %} creates {% data variables.product.prodname_code_scanning %} alerts in a repository using information from Static Analysis Results Interchange Format (SARIF) files. SARIF files can be uploaded to a repository using the API or {% data variables.product.prodname_actions %}. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
You can generate SARIF files using many static analysis security testing tools, including {{ site.data.variables.product.prodname_codeql }}. The results must use SARIF version 2.1.0. For more information, see "[About SARIF support for {{ site.data.variables.product.prodname_code_scanning }}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-sarif-support-for-code-scanning)."
|
||||
You can generate SARIF files using many static analysis security testing tools, including {% data variables.product.prodname_codeql %}. The results must use SARIF version 2.1.0. For more information, see "[About SARIF support for {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-sarif-support-for-code-scanning)."
|
||||
|
||||
You can upload the results using {{ site.data.variables.product.prodname_actions }}{% if currentVersion == "enterprise-server@2.22" %} (available if your organization is taking part in the beta program){% endif %}, the {{ site.data.variables.product.prodname_code_scanning }} API, or the {{ site.data.variables.product.prodname_codeql_runner }}. The best upload method will depend on how you generate the SARIF file, for example, if you use:
|
||||
You can upload the results using {% data variables.product.prodname_actions %}{% if currentVersion == "enterprise-server@2.22" %} (available if your organization is taking part in the beta program){% endif %}, the {% data variables.product.prodname_code_scanning %} API, or the {% data variables.product.prodname_codeql_runner %}. The best upload method will depend on how you generate the SARIF file, for example, if you use:
|
||||
|
||||
- {{ site.data.variables.product.prodname_actions }} to run the {{ site.data.variables.product.prodname_codeql }} action, there is no further action required. The {{ site.data.variables.product.prodname_codeql }} action uploads the SARIF file automatically when it completes analysis.
|
||||
- {{ site.data.variables.product.prodname_actions }} to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below).
|
||||
- The {{ site.data.variables.product.prodname_codeql_runner }}, to run {{ site.data.variables.product.prodname_code_scanning }} in your CI system, by default the runner automatically uploads results to {{ site.data.variables.product.prodname_dotcom }} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {{ site.data.variables.product.prodname_code_scanning }} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)").
|
||||
- A tool that generates results as an artifact outside of your repository, you can use the {{ site.data.variables.product.prodname_code_scanning }} API to upload the file (for more information, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)").
|
||||
- {% data variables.product.prodname_actions %} to run the {% data variables.product.prodname_codeql %} action, there is no further action required. The {% data variables.product.prodname_codeql %} action uploads the SARIF file automatically when it completes analysis.
|
||||
- {% data variables.product.prodname_actions %} to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below).
|
||||
- The {% data variables.product.prodname_codeql_runner %}, to run {% data variables.product.prodname_code_scanning %} in your CI system, by default the runner automatically uploads results to {% data variables.product.prodname_dotcom %} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)").
|
||||
- A tool that generates results as an artifact outside of your repository, you can use the {% data variables.product.prodname_code_scanning %} API to upload the file (for more information, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)").
|
||||
|
||||
### Uploading a {{ site.data.variables.product.prodname_code_scanning }} analysis with {{ site.data.variables.product.prodname_actions }}
|
||||
### Uploading a {% data variables.product.prodname_code_scanning %} analysis with {% data variables.product.prodname_actions %}
|
||||
|
||||
To use {{ site.data.variables.product.prodname_actions }} to upload a third-party SARIF file to a repository, you'll need a workflow. For more information, see "[Learn {{ site.data.variables.product.prodname_actions }}](/actions/getting-started-with-github-actions/about-github-actions)" and "[Learn {{ site.data.variables.product.prodname_actions }}](/actions/learn-github-actions)."
|
||||
To use {% data variables.product.prodname_actions %} to upload a third-party SARIF file to a repository, you'll need a workflow. For more information, see "[Learn {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)" and "[Learn {% data variables.product.prodname_actions %}](/actions/learn-github-actions)."
|
||||
|
||||
Your workflow will need to use the `upload-sarif` action, which is part of the `github/codeql-action` repository. It has input parameters that you can use to configure the upload. The main input parameter you'll use is `sarif-file`, which configures the file or directory of SARIF files to be uploaded. The directory or file path is relative to the root of the repository. For more information see the [`upload-sarif` action](https://github.com/github/codeql-action/tree/HEAD/upload-sarif).
|
||||
|
||||
The `upload-sarif` action can be configured to run when the `push` and `scheduled` event occur. For more information about {{ site.data.variables.product.prodname_actions }} events, see "[Events that trigger workflows](/actions/reference/events-that-trigger-workflows)."
|
||||
The `upload-sarif` action can be configured to run when the `push` and `scheduled` event occur. For more information about {% data variables.product.prodname_actions %} events, see "[Events that trigger workflows](/actions/reference/events-that-trigger-workflows)."
|
||||
|
||||
If your SARIF file doesn't include `partialFingerprints`, the `upload-sarif` action will calculate the `partialFingerprints` field for you and attempt to prevent duplicate alerts. {{ site.data.variables.product.prodname_dotcom }} can only create `partialFingerprints` when the repository contains both the SARIF file and the source code used in the static analysis. For more information about preventing duplicate alerts, see "[About SARIF support for code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-sarif-support-for-code-scanning#preventing-duplicate-alerts-using-fingerprints)."
|
||||
If your SARIF file doesn't include `partialFingerprints`, the `upload-sarif` action will calculate the `partialFingerprints` field for you and attempt to prevent duplicate alerts. {% data variables.product.prodname_dotcom %} can only create `partialFingerprints` when the repository contains both the SARIF file and the source code used in the static analysis. For more information about preventing duplicate alerts, see "[About SARIF support for code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-sarif-support-for-code-scanning#preventing-duplicate-alerts-using-fingerprints)."
|
||||
|
||||
#### Example workflow for SARIF files generated outside of a repository
|
||||
|
||||
@@ -43,7 +43,7 @@ You can create a new workflow that uploads SARIF files after you commit them to
|
||||
|
||||
This example workflow runs anytime commits are pushed to the repository. The action uses the `partialFingerprints` property to determine if changes have occurred. In addition to running when commits are pushed, the workflow is scheduled to run once per week. For more information, see "[Events that trigger workflows](/actions/reference/events-that-trigger-workflows)."
|
||||
|
||||
This workflow uploads the `results.sarif` file located in the root of the repository. For more information about creating a workflow file, see "[Learn {{ site.data.variables.product.prodname_actions }}](/actions/learn-github-actions)."
|
||||
This workflow uploads the `results.sarif` file located in the root of the repository. For more information about creating a workflow file, see "[Learn {% data variables.product.prodname_actions %}](/actions/learn-github-actions)."
|
||||
|
||||
Alternatively, you could modify this workflow to upload a directory of SARIF files. For example, you could place all SARIF files in a directory in the root of your repository called `sarif-output` and set the action's input parameter `sarif_file` to `sarif-output`.
|
||||
|
||||
@@ -73,11 +73,11 @@ jobs:
|
||||
|
||||
#### Example workflow that runs the ESLint analysis tool
|
||||
|
||||
If you generate your third-party SARIF file as part of a continuous integration (CI) workflow, you can add the `upload-sarif` action as a step after running your CI tests. If you don't already have a CI workflow, you can create one using a {{ site.data.variables.product.prodname_actions }} template. For more information, see the "[{{ site.data.variables.product.prodname_actions }} quickstart](/actions/quickstart)."
|
||||
If you generate your third-party SARIF file as part of a continuous integration (CI) workflow, you can add the `upload-sarif` action as a step after running your CI tests. If you don't already have a CI workflow, you can create one using a {% data variables.product.prodname_actions %} template. For more information, see the "[{% data variables.product.prodname_actions %} quickstart](/actions/quickstart)."
|
||||
|
||||
This example workflow runs anytime commits are pushed to the repository. The action uses the `partialFingerprints` property to determine if changes have occurred. In addition to running when commits are pushed, the workflow is scheduled to run once per week. For more information, see "[Events that trigger workflows](/actions/reference/events-that-trigger-workflows)."
|
||||
|
||||
The workflow shows an example of running the ESLint static analysis tool as a step in a workflow. The `Run ESLint` step runs the ESLint tool and outputs the `results.sarif` file. The workflow then uploads the `results.sarif` file to {{ site.data.variables.product.prodname_dotcom }} using the `upload-sarif` action. For more information about creating a workflow file, see "[Introduction to GitHub Actions](/actions/learn-github-actions/introduction-to-github-actions)."
|
||||
The workflow shows an example of running the ESLint static analysis tool as a step in a workflow. The `Run ESLint` step runs the ESLint tool and outputs the `results.sarif` file. The workflow then uploads the `results.sarif` file to {% data variables.product.prodname_dotcom %} using the `upload-sarif` action. For more information about creating a workflow file, see "[Introduction to GitHub Actions](/actions/learn-github-actions/introduction-to-github-actions)."
|
||||
|
||||
```yml
|
||||
name: "ESLint analysis"
|
||||
@@ -108,7 +108,7 @@ jobs:
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Workflow syntax for {{ site.data.variables.product.prodname_actions }}](/actions/reference/workflow-syntax-for-github-actions)"
|
||||
- "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions)"
|
||||
- "[Viewing your workflow history](/actions/managing-workflow-runs/viewing-workflow-run-history)"
|
||||
- "[Running {{ site.data.variables.product.prodname_code_scanning }} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)"
|
||||
- "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)"
|
||||
- "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)"
|
||||
|
||||
Reference in New Issue
Block a user