ran script/content-migrations/use-short-versions.js
This commit is contained in:
Sarah Schneider
@@ -7,9 +7,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning
|
||||
- /code-security/secure-coding/about-code-scanning
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: overview
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -46,7 +46,7 @@ You can use {% data variables.product.prodname_code_scanning %} with {% data var
|
||||
|
||||
You can view and contribute to the queries for {% data variables.product.prodname_code_scanning %} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %} queries](https://codeql.github.com/docs/writing-codeql-queries/codeql-queries/) in the {% data variables.product.prodname_codeql %} documentation.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
|
||||
## About billing for {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
|
||||
@@ -8,9 +8,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
|
||||
- /code-security/secure-coding/configuring-code-scanning
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -29,7 +29,7 @@ topics:
|
||||
## About {% data variables.product.prodname_code_scanning %} configuration
|
||||
|
||||
You can run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_name %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system. For more information, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)" or
|
||||
{%- if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}
|
||||
{%- ifversion fpt or ghes > 3.0 or ghae-next %}
|
||||
"[About {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/code-security/secure-coding/about-codeql-code-scanning-in-your-ci-system)."
|
||||
{%- else %}
|
||||
"[Running {% data variables.product.prodname_codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)."
|
||||
@@ -41,7 +41,7 @@ Before you can configure {% data variables.product.prodname_code_scanning %} for
|
||||
|
||||
{% data reusables.code-scanning.edit-workflow %}
|
||||
|
||||
{% data variables.product.prodname_codeql %} analysis is just one type of {% data variables.product.prodname_code_scanning %} you can do in {% data variables.product.prodname_dotcom %}. {% data variables.product.prodname_marketplace %}{% if currentVersion ver_gt "enterprise-server@2.21" %} on {% data variables.product.prodname_dotcom_the_website %}{% endif %} contains other {% data variables.product.prodname_code_scanning %} workflows you can use. {% if currentVersion == "free-pro-team@latest" %}You can find a selection of these on the "Get started with {% data variables.product.prodname_code_scanning %}" page, which you can access from the **{% octicon "shield" aria-label="The shield symbol" %} Security** tab.{% endif %} The specific examples given in this article relate to the {% data variables.product.prodname_codeql_workflow %} file.
|
||||
{% data variables.product.prodname_codeql %} analysis is just one type of {% data variables.product.prodname_code_scanning %} you can do in {% data variables.product.prodname_dotcom %}. {% data variables.product.prodname_marketplace %}{% ifversion ghes > 2.21 %} on {% data variables.product.prodname_dotcom_the_website %}{% endif %} contains other {% data variables.product.prodname_code_scanning %} workflows you can use. {% ifversion fpt %}You can find a selection of these on the "Get started with {% data variables.product.prodname_code_scanning %}" page, which you can access from the **{% octicon "shield" aria-label="The shield symbol" %} Security** tab.{% endif %} The specific examples given in this article relate to the {% data variables.product.prodname_codeql_workflow %} file.
|
||||
|
||||
## Editing a {% data variables.product.prodname_code_scanning %} workflow
|
||||
|
||||
@@ -75,13 +75,13 @@ If you scan on push, then the results appear in the **Security** tab for your re
|
||||
|
||||
### Scanning pull requests
|
||||
|
||||
The default {% data variables.product.prodname_codeql_workflow %} uses the `pull_request` event to trigger a code scan on pull requests targeted against the default branch. {% if currentVersion ver_gt "enterprise-server@2.21" %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see "[Disabling or limiting {% data variables.product.prodname_actions %} for a repository](/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks)."{% endif %}
|
||||
The default {% data variables.product.prodname_codeql_workflow %} uses the `pull_request` event to trigger a code scan on pull requests targeted against the default branch. {% ifversion ghes > 2.21 %}The `pull_request` event is not triggered if the pull request was opened from a private fork.{% else %}If a pull request is from a private fork, the `pull_request` event will only be triggered if you've selected the "Run workflows from fork pull requests" option in the repository settings. For more information, see "[Disabling or limiting {% data variables.product.prodname_actions %} for a repository](/github/administering-a-repository/disabling-or-limiting-github-actions-for-a-repository#enabling-workflows-for-private-repository-forks)."{% endif %}
|
||||
|
||||
For more information about the `pull_request` event, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestbranchestags)."
|
||||
|
||||
If you scan pull requests, then the results appear as alerts in a pull request check. For more information, see "[Triaging code scanning alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
### Defining the alert severities causing pull request check failure
|
||||
|
||||
By default, only alerts with the severity level of `error` will cause a pull request check failure, and a check will still succeed with alerts of lower severities. You can change the levels of alert severities that will cause a pull request check failure in your repository settings.
|
||||
@@ -150,7 +150,7 @@ This workflow scans:
|
||||
|
||||
## Specifying an operating system
|
||||
|
||||
If your code requires a specific operating system to compile, you can configure the operating system in your {% data variables.product.prodname_codeql_workflow %}. Edit the value of `jobs.analyze.runs-on` to specify the operating system for the machine that runs your {% data variables.product.prodname_code_scanning %} actions. {% if currentVersion ver_gt "enterprise-server@2.21" %}You specify the operating system by using an appropriate label as the second element in a two-element array, after `self-hosted`.{% else %}
|
||||
If your code requires a specific operating system to compile, you can configure the operating system in your {% data variables.product.prodname_codeql_workflow %}. Edit the value of `jobs.analyze.runs-on` to specify the operating system for the machine that runs your {% data variables.product.prodname_code_scanning %} actions. {% ifversion ghes > 2.21 %}You specify the operating system by using an appropriate label as the second element in a two-element array, after `self-hosted`.{% else %}
|
||||
|
||||
If you choose to use a self-hosted runner for code scanning, you can specify an operating system by using an appropriate label as the second element in a two-element array, after `self-hosted`.{% endif %}
|
||||
|
||||
@@ -161,13 +161,13 @@ jobs:
|
||||
runs-on: [self-hosted, ubuntu-latest]
|
||||
```
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners)" and "[Adding self-hosted runners](/actions/hosting-your-own-runners/adding-self-hosted-runners)."{% endif %}
|
||||
{% ifversion fpt %}For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners)" and "[Adding self-hosted runners](/actions/hosting-your-own-runners/adding-self-hosted-runners)."{% endif %}
|
||||
|
||||
{% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} supports the latest versions of Ubuntu, Windows, and macOS. Typical values for this setting are therefore: `ubuntu-latest`, `windows-latest`, and `macos-latest`. For more information, see {% if currentVersion ver_gt "enterprise-server@2.21" %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#self-hosted-runners)" and "[Using labels with self-hosted runners](/actions/hosting-your-own-runners/using-labels-with-self-hosted-runners){% else %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idruns-on){% endif %}."
|
||||
{% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} supports the latest versions of Ubuntu, Windows, and macOS. Typical values for this setting are therefore: `ubuntu-latest`, `windows-latest`, and `macos-latest`. For more information, see {% ifversion ghes > 2.21 %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#self-hosted-runners)" and "[Using labels with self-hosted runners](/actions/hosting-your-own-runners/using-labels-with-self-hosted-runners){% else %}"[Workflow syntax for GitHub Actions](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idruns-on){% endif %}."
|
||||
|
||||
{% if currentVersion ver_gt "enterprise-server@2.21" %}You must ensure that Git is in the PATH variable on your self-hosted runners.{% else %}If you use a self-hosted runner, you must ensure that Git is in the PATH variable.{% endif %}
|
||||
{% ifversion ghes > 2.21 %}You must ensure that Git is in the PATH variable on your self-hosted runners.{% else %}If you use a self-hosted runner, you must ensure that Git is in the PATH variable.{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
## Specifying the location for {% data variables.product.prodname_codeql %} databases
|
||||
|
||||
In general, you do not need to worry about where the {% data variables.product.prodname_codeql_workflow %} places {% data variables.product.prodname_codeql %} databases since later steps will automatically find databases created by previous steps. However, if you are writing a custom workflow step that requires the {% data variables.product.prodname_codeql %} database to be in a specific disk location, for example to upload the database as a workflow artifact, you can specify that location using the `db-location` parameter under the `init` action.
|
||||
@@ -215,7 +215,7 @@ If your workflow does not contain a matrix called `language`, then {% data varia
|
||||
with:
|
||||
languages: cpp, csharp, python
|
||||
```
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
## Analyzing Python dependencies
|
||||
|
||||
For GitHub-hosted runners that use Linux only, the {% data variables.product.prodname_codeql_workflow %} will try to auto-install Python dependencies to give more results for the CodeQL analysis. You can control this behavior by specifying the `setup-python-dependencies` parameter for the action called by the "Initialize CodeQL" step. By default, this parameter is set to `true`:
|
||||
@@ -230,7 +230,7 @@ Alternatively, you can install Python dependencies manually on any operating sys
|
||||
jobs:
|
||||
CodeQL-Build:
|
||||
|
||||
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
permissions:
|
||||
security-events: write
|
||||
actions: read{% endif %}
|
||||
@@ -261,7 +261,7 @@ jobs:
|
||||
```
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
## Configuring a category for the analysis
|
||||
|
||||
Use `category` to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code. The category you specify in your workflow will be included in the SARIF results file.
|
||||
|
||||
@@ -10,9 +10,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages
|
||||
- /code-security/secure-coding/configuring-the-codeql-workflow-for-compiled-languages
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -46,7 +46,7 @@ If your workflow uses a `language` matrix, `autobuild` attempts to build each of
|
||||
|
||||
{% note %}
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}**Note**: For instructions on how to make sure your {% data variables.actions.hosted_runner %} has the required software installed, see "[Creating custom images](/actions/using-github-hosted-runners/creating-custom-images)."
|
||||
{% ifversion ghae %}**Note**: For instructions on how to make sure your {% data variables.actions.hosted_runner %} has the required software installed, see "[Creating custom images](/actions/using-github-hosted-runners/creating-custom-images)."
|
||||
{% else %}
|
||||
**Note**: If you use self-hosted runners for {% data variables.product.prodname_actions %}, you may need to install additional software to use the `autobuild` process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. For more information, see "[Specifications for {% data variables.product.prodname_dotcom %}-hosted runners](/actions/reference/specifications-for-github-hosted-runners/#supported-software)".
|
||||
{% endif %}
|
||||
|
||||
@@ -6,9 +6,9 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/automatically-scanning-your-code-for-vulnerabilities-and-errors
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
topics:
|
||||
- Advanced Security
|
||||
- Code scanning
|
||||
|
||||
@@ -5,9 +5,9 @@ intro: 'From the security view, you can view, fix, dismiss, or delete alerts for
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'If you have write permission to a repository you can manage {% data variables.product.prodname_code_scanning %} alerts for that repository.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/managing-alerts-from-automated-code-scanning
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/managing-alerts-from-code-scanning
|
||||
@@ -51,11 +51,11 @@ You need write permission to view a summary of all the alerts for a repository o
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
{% data reusables.repositories.sidebar-code-scanning-alerts %}
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
1. Optionally, use{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" %} the free text search box or{% endif %} the drop-down menus to filter alerts. For example, you can filter by the tool that was used to identify alerts.
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
1. Optionally, use{% ifversion fpt or ghes > 3.1 %} the free text search box or{% endif %} the drop-down menus to filter alerts. For example, you can filter by the tool that was used to identify alerts.
|
||||
{% endif %}
|
||||
1. Under "{% data variables.product.prodname_code_scanning_capc %}," click the alert you'd like to explore.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
|
||||
{% else %}
|
||||
|
||||
@@ -65,7 +65,7 @@ You need write permission to view a summary of all the alerts for a repository o
|
||||
1. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code.
|
||||
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" %}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
{% note %}
|
||||
|
||||
**Note:** For {% data variables.product.prodname_code_scanning %} analysis with {% data variables.product.prodname_codeql %}, you can see information about the latest run in a header at the top of the list of {% data variables.product.prodname_code_scanning %} alerts for the repository.
|
||||
@@ -76,7 +76,7 @@ For example, you can see when the last scan ran, the number of lines of code ana
|
||||
{% endnote %}
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" %}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
## Searching {% data variables.product.prodname_code_scanning %} alerts
|
||||
|
||||
You can search the list of alerts. This is useful if there is a large number of alerts in your repository, or if you don't know the exact name for an alert for example. {% data variables.product.product_name %} performs the free text search across:
|
||||
@@ -117,11 +117,11 @@ Anyone with write permission for a repository can fix an alert by committing a c
|
||||
|
||||
If you have write permission for a repository, you can view fixed alerts by viewing the summary of alerts and clicking **Closed**. For more information, see "[Viewing the alerts for a repository](#viewing-the-alerts-for-a-repository)." The "Closed" list shows fixed alerts and alerts that users have dismissed.
|
||||
|
||||
You can use{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" %} the free text search or{% endif %} the filters to display a subset of alerts and then in turn mark all matching alerts as closed.
|
||||
You can use{% ifversion fpt or ghes > 3.1 %} the free text search or{% endif %} the filters to display a subset of alerts and then in turn mark all matching alerts as closed.
|
||||
|
||||
Alerts may be fixed in one branch but not in another. You can use the "Branch" drop-down menu, on the summary of alerts, to check whether an alert is fixed in a particular branch.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
|
||||
{% else %}
|
||||
|
||||
@@ -157,9 +157,9 @@ To dismiss or delete alerts:
|
||||
|
||||
|
||||
|
||||
Optionally, you can use{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" %} the free text search or{% endif %} the filters to display a subset of alerts and then delete all matching alerts at once. For example, if you have removed a query from {% data variables.product.prodname_codeql %} analysis, you can use the "Rule" filter to list just the alerts for that query and then select and delete all of those alerts.
|
||||
Optionally, you can use{% ifversion fpt or ghes > 3.1 %} the free text search or{% endif %} the filters to display a subset of alerts and then delete all matching alerts at once. For example, if you have removed a query from {% data variables.product.prodname_codeql %} analysis, you can use the "Rule" filter to list just the alerts for that query and then select and delete all of those alerts.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
|
||||
{% else %}
|
||||
|
||||
@@ -167,7 +167,7 @@ To dismiss or delete alerts:
|
||||
|
||||
1. If you want to dismiss an alert, it's important to explore the alert first, so that you can choose the correct dismissal reason. Click the alert you'd like to explore.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
|
||||
{% else %}
|
||||
|
||||
|
||||
@@ -7,9 +7,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-a-container
|
||||
- /code-security/secure-coding/running-codeql-code-scanning-in-a-container
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -28,7 +28,7 @@ topics:
|
||||
|
||||
If you're setting up {% data variables.product.prodname_code_scanning %} for a compiled language, and you're building the code in a containerized environment, the analysis may fail with the error message "No source code was seen during the build." This indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code as it was compiled.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.0 or ghae-next %}
|
||||
You must run {% data variables.product.prodname_codeql %} inside the container in which you build your code. This applies whether you are using the {% data variables.product.prodname_codeql_cli %}, the {% data variables.product.prodname_codeql_runner %}, or {% data variables.product.prodname_actions %}. For the {% data variables.product.prodname_codeql_cli %} or the {% data variables.product.prodname_codeql_runner %}, see "[Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)" or "[Running {% data variables.product.prodname_codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)" for more information. If you're using {% data variables.product.prodname_actions %}, configure your workflow to run all the actions in the same container. For more information, see "[Example workflow](#example-workflow)."
|
||||
{% else %}
|
||||
You must run {% data variables.product.prodname_codeql %} inside the container in which you build your code. This applies whether you are using the {% data variables.product.prodname_codeql_runner %} or {% data variables.product.prodname_actions %}. For the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)" for more information. If you're using {% data variables.product.prodname_actions %}, configure your workflow to run all the actions in the same container. For more information, see "[Example workflow](#example-workflow)."
|
||||
@@ -60,7 +60,7 @@ on:
|
||||
jobs:
|
||||
analyze:
|
||||
name: Analyze
|
||||
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
permissions:
|
||||
security-events: write
|
||||
actions: read{% endif %}
|
||||
|
||||
@@ -11,9 +11,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/setting-up-code-scanning-for-a-repository
|
||||
- /code-security/secure-coding/setting-up-code-scanning-for-a-repository
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -34,14 +34,14 @@ You decide how to generate {% data variables.product.prodname_code_scanning %} a
|
||||
|
||||
## Setting up {% data variables.product.prodname_code_scanning %} using actions
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}Using actions to run {% data variables.product.prodname_code_scanning %} will use minutes. For more information, see "[About billing for {% data variables.product.prodname_actions %}](/billing/managing-billing-for-github-actions/about-billing-for-github-actions)."{% endif %}
|
||||
{% ifversion fpt %}Using actions to run {% data variables.product.prodname_code_scanning %} will use minutes. For more information, see "[About billing for {% data variables.product.prodname_actions %}](/billing/managing-billing-for-github-actions/about-billing-for-github-actions)."{% endif %}
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
3. To the right of "{% data variables.product.prodname_code_scanning_capc %} alerts", click **Set up {% data variables.product.prodname_code_scanning %}**. {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}If {% data variables.product.prodname_code_scanning %} is missing, you need to ask an organization owner or repository administrator to enable {% data variables.product.prodname_GH_advanced_security %}. For more information, see "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)" or "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."{% endif %}
|
||||
3. To the right of "{% data variables.product.prodname_code_scanning_capc %} alerts", click **Set up {% data variables.product.prodname_code_scanning %}**. {% ifversion fpt or ghes > 3.0 %}If {% data variables.product.prodname_code_scanning %} is missing, you need to ask an organization owner or repository administrator to enable {% data variables.product.prodname_GH_advanced_security %}. For more information, see "[Managing security and analysis settings for your organization](/organizations/keeping-your-organization-secure/managing-security-and-analysis-settings-for-your-organization)" or "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."{% endif %}
|
||||
|
||||
4. Under "Get started with {% data variables.product.prodname_code_scanning %}", click **Set up this workflow** on the {% data variables.product.prodname_codeql_workflow %} or on a third-party workflow.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}Workflows are only displayed if they are relevant for the programming languages detected in the repository. The {% data variables.product.prodname_codeql_workflow %} is always displayed, but the "Set up this workflow" button is only enabled if {% data variables.product.prodname_codeql %} analysis supports the languages present in the repository.{% endif %}
|
||||
{% ifversion fpt or ghes > 2.22 %}Workflows are only displayed if they are relevant for the programming languages detected in the repository. The {% data variables.product.prodname_codeql_workflow %} is always displayed, but the "Set up this workflow" button is only enabled if {% data variables.product.prodname_codeql %} analysis supports the languages present in the repository.{% endif %}
|
||||
5. To customize how {% data variables.product.prodname_code_scanning %} scans your code, edit the workflow.
|
||||
|
||||
Generally you can commit the {% data variables.product.prodname_codeql_workflow %} without making any changes to it. However, many of the third-party workflows require additional configuration, so read the comments in the workflow before committing.
|
||||
@@ -80,7 +80,7 @@ There are other situations where there may be no analysis for the latest commit
|
||||
|
||||
To check whether a branch has been scanned, go to the {% data variables.product.prodname_code_scanning_capc %} page, click the **Branch** drop-down and select the relevant branch.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
|
||||
{% else %}
|
||||
|
||||
|
||||
@@ -8,9 +8,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests
|
||||
- /code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -29,7 +29,7 @@ In repositories where {% data variables.product.prodname_code_scanning %} is con
|
||||
|
||||
If {% data variables.product.prodname_code_scanning %} has any results with a severity of `error`, the check fails and the error is reported in the check results. If all the results found by {% data variables.product.prodname_code_scanning %} have lower severities, the alerts are treated as warnings or notices and the check succeeds.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}You can override the default behavior in your repository settings, by specifying the level of severities that will cause a pull request check failure. For more information, see "[Defining the alert severities causing pull request check failure](/code-security/secure-coding/configuring-code-scanning#defining-the-alert-severities-causing-pull-request-check-failure)".
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}You can override the default behavior in your repository settings, by specifying the level of severities that will cause a pull request check failure. For more information, see "[Defining the alert severities causing pull request check failure](/code-security/secure-coding/configuring-code-scanning#defining-the-alert-severities-causing-pull-request-check-failure)".
|
||||
|
||||
{% endif %}If your pull request targets a protected branch that uses {% data variables.product.prodname_code_scanning %}, and the repository owner has configured required status checks, then you must either fix or dismiss all error alerts before the pull request can be merged. For more information, see "[About protected branches](/github/administering-a-repository/about-protected-branches#require-status-checks-before-merging)."
|
||||
|
||||
|
||||
@@ -8,9 +8,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-the-codeql-workflow
|
||||
- /code-security/secure-coding/troubleshooting-the-codeql-workflow
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -45,7 +45,7 @@ If an automatic build of code for a compiled language within your project fails,
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
analyze:{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
analyze:{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
permissions:
|
||||
security-events: write
|
||||
actions: read{% endif %}
|
||||
@@ -133,7 +133,7 @@ If you split your analysis into multiple workflows as described above, we still
|
||||
|
||||
If your analysis is still too slow to be run during `push` or `pull_request` events, then you may want to only trigger analysis on the `schedule` event. For more information, see "[Events](/actions/learn-github-actions/introduction-to-github-actions#events)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
## Results differ between analysis platforms
|
||||
|
||||
If you are analyzing code written in Python, you may see different results depending on whether you run the {% data variables.product.prodname_codeql_workflow %} on Linux, macOS, or Windows.
|
||||
@@ -149,7 +149,7 @@ If the run of a workflow for {% data variables.product.prodname_code_scanning %}
|
||||
## Error: "Out of disk" or "Out of memory"
|
||||
|
||||
On very large projects, {% data variables.product.prodname_codeql %} may run out of disk or memory on the runner.
|
||||
{% if currentVersion == "free-pro-team@latest" %}If you encounter this issue on a hosted {% data variables.product.prodname_actions %} runner, contact {% data variables.contact.contact_support %} so that we can investigate the problem.
|
||||
{% ifversion fpt %}If you encounter this issue on a hosted {% data variables.product.prodname_actions %} runner, contact {% data variables.contact.contact_support %} so that we can investigate the problem.
|
||||
{% else %}If you encounter this issue, try increasing the memory on the runner.{% endif %}
|
||||
|
||||
## Warning: "git checkout HEAD^2 is no longer necessary"
|
||||
|
||||
@@ -5,9 +5,9 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'If you have write permissions to a repository, you can view the {% data variables.product.prodname_code_scanning %} logs for that repository.'
|
||||
miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
topics:
|
||||
- Security
|
||||
---
|
||||
@@ -19,7 +19,7 @@ topics:
|
||||
|
||||
You can use a variety of tools to set up {% data variables.product.prodname_code_scanning %} in your repository. For more information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository#options-for-setting-up-code-scanning)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
The log and diagnostic information available to you depends on the method you use for {% data variables.product.prodname_code_scanning %} in your repository. You can check the type of {% data variables.product.prodname_code_scanning %} you're using in the **Security** tab of your repository, by using the **Tool** drop-down menu in the alert list. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository)."
|
||||
|
||||
## About analysis and diagnostic information
|
||||
@@ -69,7 +69,7 @@ After setting up {% data variables.product.prodname_code_scanning %} for your re
|
||||
|
||||
**Note:** If you raised a pull request to add the {% data variables.product.prodname_code_scanning %} workflow to the repository, alerts from that pull request aren't displayed directly on the {% data variables.product.prodname_code_scanning_capc %} page until the pull request is merged. If any alerts were found you can view these, before the pull request is merged, by clicking the **_n_ alerts found** link in the banner on the {% data variables.product.prodname_code_scanning_capc %} page.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
{% ifversion fpt or ghes > 3.1 %}
|
||||
|
||||
{% else %}
|
||||
|
||||
|
||||
@@ -7,9 +7,9 @@ redirect_from:
|
||||
- /github/managing-security-vulnerabilities/finding-security-vulnerabilities-in-your-projects-code
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
topics:
|
||||
- Advanced Security
|
||||
- Code scanning
|
||||
|
||||
@@ -7,9 +7,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning
|
||||
- /code-security/secure-coding/about-integration-with-code-scanning
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: overview
|
||||
topics:
|
||||
- Advanced Security
|
||||
|
||||
@@ -7,9 +7,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/managing-results-from-code-scanning
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/integrating-with-code-scanning
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
topics:
|
||||
- Advanced Security
|
||||
- Code scanning
|
||||
|
||||
@@ -9,9 +9,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning
|
||||
- /code-security/secure-coding/sarif-support-for-code-scanning
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: reference
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -31,10 +31,10 @@ To upload a SARIF file from a third-party static code analysis engine, you'll ne
|
||||
|
||||
If you're using {% data variables.product.prodname_actions %} with the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/code-security/secure-coding/setting-up-code-scanning-for-a-repository)" or "[Running {% data variables.product.prodname_codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.0 or ghae-next %}
|
||||
If you're using the {% data variables.product.prodname_codeql_cli %}, then you can specify the version of SARIF to use. For more information, see "[Configuring {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-cli-in-your-ci-system#analyzing-a-codeql-database)."{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
You can upload multiple SARIF files for the same tool and commit, and analyze each file using {% data variables.product.prodname_code_scanning %}. You can indicate a "category" for each analysis by specifying a `runAutomationDetails.id` in each file. Only SARIF files with the same category will overwrite each other. For more information about this property, see [`runAutomationDetails` object](#runautomationdetails-object) below.
|
||||
|
||||
{% endif %}
|
||||
@@ -137,7 +137,7 @@ A location within a programming artifact, such as a file in the repository or a
|
||||
| `region.endLine` | **Required.** The line number of the last character in the region.
|
||||
| `region.endColumn` | **Required.** The column number of the character following the end of the region.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
### `runAutomationDetails` object
|
||||
|
||||
The `runAutomationDetails` object contains information that specifies the identity of a run.
|
||||
@@ -234,7 +234,7 @@ This SARIF output file has example values to show the minimum required propertie
|
||||
|
||||
This SARIF output file has example values to show all supported SARIF properties for {% data variables.product.prodname_code_scanning %}.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
```json
|
||||
{
|
||||
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
|
||||
|
||||
@@ -9,9 +9,9 @@ redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github
|
||||
- /code-security/secure-coding/uploading-a-sarif-file-to-github
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -33,10 +33,10 @@ topics:
|
||||
|
||||
You can generate SARIF files using many static analysis security testing tools, including {% data variables.product.prodname_codeql %}. The results must use SARIF version 2.1.0. For more information, see "[SARIF support for {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/sarif-support-for-code-scanning)."
|
||||
|
||||
You can upload the results using {% data variables.product.prodname_actions %}, the {% data variables.product.prodname_code_scanning %} API, {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}the {% data variables.product.prodname_codeql_cli %}, {% endif %}or the {% data variables.product.prodname_codeql_runner %}. The best upload method will depend on how you generate the SARIF file, for example, if you use:
|
||||
You can upload the results using {% data variables.product.prodname_actions %}, the {% data variables.product.prodname_code_scanning %} API, {% ifversion fpt or ghes > 3.0 or ghae-next %}the {% data variables.product.prodname_codeql_cli %}, {% endif %}or the {% data variables.product.prodname_codeql_runner %}. The best upload method will depend on how you generate the SARIF file, for example, if you use:
|
||||
|
||||
- {% data variables.product.prodname_actions %} to run the {% data variables.product.prodname_codeql %} action, there is no further action required. The {% data variables.product.prodname_codeql %} action uploads the SARIF file automatically when it completes analysis.
|
||||
- {% data variables.product.prodname_actions %} to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below). {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}
|
||||
- {% data variables.product.prodname_actions %} to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below). {% ifversion fpt or ghes > 3.0 or ghae-next %}
|
||||
- The {% data variables.product.prodname_codeql_cli %} to run {% data variables.product.prodname_code_scanning %} in your CI system, you can use the CLI to upload results to {% data variables.product.prodname_dotcom %} (for more information, see "[Installing {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/installing-codeql-cli-in-your-ci-system)").{% endif %}
|
||||
- The {% data variables.product.prodname_codeql_runner %}, to run {% data variables.product.prodname_code_scanning %} in your CI system, by default the runner automatically uploads results to {% data variables.product.prodname_dotcom %} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {% data variables.product.prodname_codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)").
|
||||
- A tool that generates results as an artifact outside of your repository, you can use the {% data variables.product.prodname_code_scanning %} API to upload the file (for more information, see "[Upload an analysis as SARIF data](/rest/reference/code-scanning#upload-an-analysis-as-sarif-data)").
|
||||
@@ -77,7 +77,7 @@ on:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
permissions:
|
||||
security-events: write{% endif %}
|
||||
steps:
|
||||
@@ -111,7 +111,7 @@ on:
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
runs-on: ubuntu-latest{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
permissions:
|
||||
security-events: write{% endif %}
|
||||
steps:
|
||||
@@ -132,7 +132,7 @@ jobs:
|
||||
## Further reading
|
||||
|
||||
- "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions)"
|
||||
- "[Viewing your workflow history](/actions/managing-workflow-runs/viewing-workflow-run-history)"{%- if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}
|
||||
- "[Viewing your workflow history](/actions/managing-workflow-runs/viewing-workflow-run-history)"{%- ifversion fpt or ghes > 3.0 or ghae-next %}
|
||||
- "[About {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/code-security/secure-coding/about-codeql-code-scanning-in-your-ci-system)"{% else %}
|
||||
- "[Running {% data variables.product.prodname_codeql_runner %} in your CI system](/code-security/secure-coding/running-codeql-runner-in-your-ci-system)"{% endif %}
|
||||
- "[Upload an analysis as SARIF data](/rest/reference/code-scanning#upload-an-analysis-as-sarif-data)"
|
||||
|
||||
@@ -4,9 +4,9 @@ shortTitle: Code scanning in your CI
|
||||
intro: 'You can analyze your code with {% data variables.product.prodname_codeql %} in a third-party continuous integration system and upload the results to {% data variables.product.product_location %}. The resulting {% data variables.product.prodname_code_scanning %} alerts are shown alongside any alerts generated within {% data variables.product.product_name %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
topics:
|
||||
- Advanced Security
|
||||
- Code scanning
|
||||
@@ -31,7 +31,7 @@ redirect_from:
|
||||
You can run {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_name %} using {% data variables.product.prodname_actions %}. Alternatively, if you use a third-party continuous integration or continuous delivery/deployment (CI/CD) system, you can run {% data variables.product.prodname_codeql %} analysis in your existing system and upload the results to {% data variables.product.product_location %}.
|
||||
|
||||
<!--Content for GitHub.com, GHAE next, and GHES 3.2. Both CodeQL CLI and CodeQL runner are available, but CodeQL CLI preferred -->
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
|
||||
You add the {% data variables.product.prodname_codeql_cli %} to your third-party system, then call the tool to analyze code and upload the SARIF results to {% data variables.product.product_name %}. The resulting {% data variables.product.prodname_code_scanning %} alerts are shown alongside any alerts generated within {% data variables.product.product_name %}.
|
||||
|
||||
@@ -56,7 +56,7 @@ For more information, see "[Installing {% data variables.product.prodname_codeql
|
||||
{% endif %}
|
||||
|
||||
<!--Content for GHES 3.1 only. Both CodeQL CLI and CodeQL runner are available -->
|
||||
{% if currentVersion == "enterprise-server@3.1" %}
|
||||
{% ifversion ghes = 3.1 %}
|
||||
You add the {% data variables.product.prodname_codeql_cli %} or the {% data variables.product.prodname_codeql_runner %} to your third-party system, then call the tool to analyze code and upload the SARIF results to {% data variables.product.product_name %}. The resulting {% data variables.product.prodname_code_scanning %} alerts are shown alongside any alerts generated within {% data variables.product.product_name %}.
|
||||
|
||||
{% data reusables.code-scanning.upload-sarif-ghas %}
|
||||
@@ -83,7 +83,7 @@ For more information, see "[Running {% data variables.product.prodname_codeql_ru
|
||||
{% endif %}
|
||||
|
||||
<!--Content for GHAE and GHES 3.0 only. Only CodeQL runner is available -->
|
||||
{% if currentVersion == "enterprise-server@3.0" or currentVersion == "github-ae@latest" %}
|
||||
{% ifversion ghes = 3.0 or ghae %}
|
||||
{% data reusables.code-scanning.upload-sarif-ghas %}
|
||||
|
||||
You add the {% data variables.product.prodname_codeql_runner %} to your third-party system, then call the tool to analyze code and upload the SARIF results to {% data variables.product.product_name %}. The resulting {% data variables.product.prodname_code_scanning %} alerts are shown alongside any alerts generated within {% data variables.product.product_name %}.
|
||||
|
||||
@@ -5,9 +5,9 @@ intro: 'You can configure your continuous integration system to run the {% data
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
miniTocMaxHeadingLevel: 3
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.1'
|
||||
github-ae: 'next'
|
||||
fpt: '*'
|
||||
ghes: '>=3.1'
|
||||
ghae: next
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -27,7 +27,7 @@ Once you've made the {% data variables.product.prodname_codeql_cli %} available
|
||||
|
||||
You use three different commands to generate results and upload them to {% data variables.product.product_name %}:
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
<!--Option to analyze multiple languages with one call-->
|
||||
1. `database create` to create a {% data variables.product.prodname_codeql %} database to represent the hierarchical structure of each supported programming language in the repository.
|
||||
2. ` database analyze` to run queries to analyze each {% data variables.product.prodname_codeql %} database and summarize the results in a SARIF file.
|
||||
@@ -51,7 +51,7 @@ You can display the command-line help for any command using the <nobr>`--help`</
|
||||
2. Set up the environment for the codebase, making sure that any dependencies are available. For more information, see [Creating databases for non-compiled languages](https://codeql.github.com/docs/codeql-cli/creating-codeql-databases/#creating-databases-for-non-compiled-languages) and [Creating databases for compiled languages](https://codeql.github.com/docs/codeql-cli/creating-codeql-databases/#creating-databases-for-compiled-languages) in the documentation for the {% data variables.product.prodname_codeql_cli %}.
|
||||
3. Find the build command, if any, for the codebase. Typically this is available in a configuration file in the CI system.
|
||||
4. Run `codeql database create` from the checkout root of your repository and build the codebase.
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
```shell
|
||||
# Single supported language - create one CodeQL databsae
|
||||
codeql database create <database> --command<build> --language=<language-identifier>
|
||||
@@ -74,15 +74,15 @@ You can display the command-line help for any command using the <nobr>`--help`</
|
||||
| Option | Required | Usage |
|
||||
|--------|:--------:|-----|
|
||||
| `<database>` | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the name and location of a directory to create for the {% data variables.product.prodname_codeql %} database. The command will fail if you try to overwrite an existing directory. If you also specify `--db-cluster`, this is the parent directory and a subdirectory is created for each language analyzed.|
|
||||
| <nobr>`--language`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the identifier for the language to create a database for, one of: `{% data reusables.code-scanning.codeql-languages-keywords %}` (use `javascript` to analyze TypeScript code). {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}When used with <nobr>`--db-cluster`</nobr>, the option accepts a comma-separated list, or can be specified more than once.{% endif %}
|
||||
| <nobr>`--command`</nobr> | | Recommended. Use to specify the build command or script that invokes the build process for the codebase. Commands are run from the current folder or, where it is defined, from <nobr>`--source-root`</nobr>. Not needed for Python and JavaScript/TypeScript analysis. | {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
| <nobr>`--language`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the identifier for the language to create a database for, one of: `{% data reusables.code-scanning.codeql-languages-keywords %}` (use `javascript` to analyze TypeScript code). {% ifversion fpt or ghes > 3.1 or ghae-next %}When used with <nobr>`--db-cluster`</nobr>, the option accepts a comma-separated list, or can be specified more than once.{% endif %}
|
||||
| <nobr>`--command`</nobr> | | Recommended. Use to specify the build command or script that invokes the build process for the codebase. Commands are run from the current folder or, where it is defined, from <nobr>`--source-root`</nobr>. Not needed for Python and JavaScript/TypeScript analysis. | {% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
| <nobr>`--db-cluster`</nobr> | | Optional. Use in multi-language codebases to generate one database for each language specified by <nobr>`--language`</nobr>.
|
||||
| <nobr>`--no-run-unnecessary-builds`</nobr> | | Recommended. Use to suppress the build command for languages where the {% data variables.product.prodname_codeql_cli %} does not need to monitor the build (for example, Python and JavaScript/TypeScript). {% endif %}
|
||||
| <nobr>`--source-root`</nobr> | | Optional. Use if you run the CLI outside the checkout root of the repository. By default, the `database create` command assumes that the current directory is the root directory for the source files, use this option to specify a different location. |
|
||||
|
||||
For more information, see [Creating {% data variables.product.prodname_codeql %} databases](https://codeql.github.com/docs/codeql-cli/creating-codeql-databases/) in the documentation for the {% data variables.product.prodname_codeql_cli %}.
|
||||
|
||||
### {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}Single language example{% else %}Basic example{% endif %}
|
||||
### {% ifversion fpt or ghes > 3.1 or ghae-next %}Single language example{% else %}Basic example{% endif %}
|
||||
|
||||
This example creates a {% data variables.product.prodname_codeql %} database for the repository checked out at `/checkouts/example-repo`. It uses the JavaScript extractor to create a hierarchical representation of the JavaScript and TypeScript code in the repository. The resulting database is stored in `/codeql-dbs/example-repo`.
|
||||
|
||||
@@ -100,7 +100,7 @@ $ codeql database create /codeql-dbs/example-repo --language=javascript \
|
||||
> Successfully created database at /codeql-dbs/example-repo.
|
||||
```
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
### Multiple language example
|
||||
|
||||
This example creates two {% data variables.product.prodname_codeql %} databases for the repository checked out at `/checkouts/example-repo-multi`. It uses:
|
||||
@@ -142,7 +142,7 @@ $
|
||||
--output=<output> <queries>
|
||||
```
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
{% note %}
|
||||
|
||||
**Note:** If you analyze more than one {% data variables.product.prodname_codeql %} database for a single commit, you must specify a SARIF category for each set of results generated by this command. When you upload the results to {% data variables.product.product_name %}, {% data variables.product.prodname_code_scanning %} uses this category to store the results for each language separately. If you forget to do this, each upload overwrites the previous results.
|
||||
@@ -158,22 +158,22 @@ codeql database analyze <database> --format=<format> \
|
||||
|--------|:--------:|-----|
|
||||
| `<database>` | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the path for the directory that contains the {% data variables.product.prodname_codeql %} database to analyze. |
|
||||
| `<queries>` | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the queries to run. To run the standard queries used for {% data variables.product.prodname_code_scanning %}, use: `<language>-code-scanning.qls` where `<language>` is the short code for the language of the database. To see the other query suites included in the {% data variables.product.prodname_codeql_cli %} bundle, look in `/<extraction-root>/codeql/qlpacks/codeql-<language>/codeql-suites`. For information about creating your own query suite, see [Creating CodeQL query suites](https://codeql.github.com/docs/codeql-cli/creating-codeql-query-suites/) in the documentation for the {% data variables.product.prodname_codeql_cli %}.
|
||||
| <nobr>`--format`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the format for the results file generated by the command. For upload to {% data variables.product.company_short %} this should be: {% if currentVersion == "free-pro-team@latest" or currentVersion == "github-ae@latest" %}`sarif-latest`{% else %}`sarifv2.1.0`{% endif %}. For more information, see "[SARIF support for {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/sarif-support-for-code-scanning)."
|
||||
| <nobr>`--output`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify where to save the SARIF results file.{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
| <nobr>`--format`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the format for the results file generated by the command. For upload to {% data variables.product.company_short %} this should be: {% ifversion fpt or ghae %}`sarif-latest`{% else %}`sarifv2.1.0`{% endif %}. For more information, see "[SARIF support for {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/sarif-support-for-code-scanning)."
|
||||
| <nobr>`--output`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify where to save the SARIF results file.{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
| <nobr>`--sarif-category`<nobr> | {% octicon "question" aria-label="Required with multiple results sets" %} | Optional for single database analysis. Required to define the language when you analyze multiple databases for a single commit in a repository. Specify a category to include in the SARIF results file for this analysis. A category is used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code.|{% endif %}
|
||||
| <nobr>`--threads`</nobr> | | Optional. Use if you want to use more than one thread to run queries. The default value is `1`. You can specify more threads to speed up query execution. To set the number of threads to the number of logical processors, specify `0`.
|
||||
| <nobr>`--verbose`</nobr> | | Optional. Use to get more detailed information about the analysis process{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %} and diagnostic data from the database creation process{% endif %}.
|
||||
| <nobr>`--verbose`</nobr> | | Optional. Use to get more detailed information about the analysis process{% ifversion fpt or ghes > 3.1 or ghae-next %} and diagnostic data from the database creation process{% endif %}.
|
||||
|
||||
For more information, see [Analyzing databases with the {% data variables.product.prodname_codeql_cli %}](https://codeql.github.com/docs/codeql-cli/analyzing-databases-with-the-codeql-cli/) in the documentation for the {% data variables.product.prodname_codeql_cli %}.
|
||||
|
||||
### Basic example
|
||||
|
||||
This example analyzes a {% data variables.product.prodname_codeql %} database stored at `/codeql-dbs/example-repo` and saves the results as a SARIF file: `/temp/example-repo-js.sarif`. {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}It uses `--sarif-category` to include extra information in the SARIF file that identifies the results as JavaScript. This is essential when you have more than one {% data variables.product.prodname_codeql %} database to analyze for a single commit in a repository.{% endif %}
|
||||
This example analyzes a {% data variables.product.prodname_codeql %} database stored at `/codeql-dbs/example-repo` and saves the results as a SARIF file: `/temp/example-repo-js.sarif`. {% ifversion fpt or ghes > 3.1 or ghae-next %}It uses `--sarif-category` to include extra information in the SARIF file that identifies the results as JavaScript. This is essential when you have more than one {% data variables.product.prodname_codeql %} database to analyze for a single commit in a repository.{% endif %}
|
||||
|
||||
```
|
||||
$ codeql database analyze /codeql-dbs/example-repo \
|
||||
javascript-code-scanning.qls {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}--sarif-category=javascript{% endif %}
|
||||
--format={% if currentVersion == "free-pro-team@latest" or currentVersion == "github-ae@latest" %}sarif-latest{% else %}sarifv2.1.0{% endif %} --output=/temp/example-repo-js.sarif
|
||||
javascript-code-scanning.qls {% ifversion fpt or ghes > 3.1 or ghae-next %}--sarif-category=javascript{% endif %}
|
||||
--format={% ifversion fpt or ghae %}sarif-latest{% else %}sarifv2.1.0{% endif %} --output=/temp/example-repo-js.sarif
|
||||
|
||||
> Running queries.
|
||||
> Compiling query plan for /codeql-home/codeql/qlpacks/
|
||||
@@ -197,15 +197,15 @@ When you have decided on the most secure and reliable method for your CI server,
|
||||
```shell
|
||||
echo "$UPLOAD_TOKEN" | codeql github upload-results --repository=<repository-name> \
|
||||
--ref=<ref> --commit=<commit> --sarif=<file> \
|
||||
{% if currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}--github-url=<URL> {% endif %}--github-auth-stdin
|
||||
{% ifversion ghes > 3.0 or ghae-next %}--github-url=<URL> {% endif %}--github-auth-stdin
|
||||
```
|
||||
|
||||
| Option | Required | Usage |
|
||||
|--------|:--------:|-----|
|
||||
| <nobr>`--repository`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the *OWNER/NAME* of the repository to upload data to. The owner must be an organization within an enterprise that has a license for {% data variables.product.prodname_GH_advanced_security %} and {% data variables.product.prodname_GH_advanced_security %} must be enabled for the repository{% if currentVersion == "free-pro-team@latest" %}, unless the repository is public{% endif %}. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."
|
||||
| <nobr>`--repository`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the *OWNER/NAME* of the repository to upload data to. The owner must be an organization within an enterprise that has a license for {% data variables.product.prodname_GH_advanced_security %} and {% data variables.product.prodname_GH_advanced_security %} must be enabled for the repository{% ifversion fpt %}, unless the repository is public{% endif %}. For more information, see "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."
|
||||
| <nobr>`--ref`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the name of the `ref` you checked out and analyzed so that the results can be matched to the correct code. For a branch use: `refs/heads/BRANCH-NAME`, for the head commit of a pull request use `refs/pulls/NUMBER/head`, or for the {% data variables.product.product_name %}-generated merge commit of a pull request use `refs/pulls/NUMBER/merge`.
|
||||
| <nobr>`--commit`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the full SHA of the commit you analyzed.
|
||||
| <nobr>`--sarif`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the SARIF file to load.{% if currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}
|
||||
| <nobr>`--sarif`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the SARIF file to load.{% ifversion ghes > 3.0 or ghae-next %}
|
||||
| <nobr>`--github-url`</nobr> | {% octicon "check-circle-fill" aria-label="Required" %} | Specify the URL for {% data variables.product.product_name %}.{% endif %}
|
||||
| <nobr>`--github-auth-stdin`</nobr> | | Optional. Use to pass the CLI the {% data variables.product.prodname_github_app %} or personal access token created for authentication with {% data variables.product.company_short %}'s REST API via standard input. This is not needed if the command has access to a `GITHUB_TOKEN` environment variable set with this token.
|
||||
|
||||
@@ -218,13 +218,13 @@ This example uploads results from the SARIF file `temp/example-repo-js.sarif` to
|
||||
```
|
||||
$ echo $UPLOAD_TOKEN | codeql github upload-results --repository=my-org/example-repo \
|
||||
--ref=refs/heads/main --commit=deb275d2d5fe9a522a0b7bd8b6b6a1c939552718 \
|
||||
--sarif=/temp/example-repo-js.sarif {% if currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}--github-url={% data variables.command_line.git_url_example %} \
|
||||
--sarif=/temp/example-repo-js.sarif {% ifversion ghes > 3.0 or ghae-next %}--github-url={% data variables.command_line.git_url_example %} \
|
||||
{% endif %}--github-auth-stdin
|
||||
```
|
||||
|
||||
There is no output from this command unless the upload was unsuccessful. The command prompt returns when the upload is complete and data processing has begun. On smaller codebases, you should be able to explore the {% data variables.product.prodname_code_scanning %} alerts in {% data variables.product.product_name %} shortly afterward. You can see alerts directly in the pull request or on the **Security** tab for branches, depending on the code you checked out. For more information, see "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)" and "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.1 or ghae-next %}
|
||||
## Example CI configuration for {% data variables.product.prodname_codeql %} analysis
|
||||
|
||||
This is an example of the series of commands that you might use to analyze a codebase with two supported languages and then upload the results to {% data variables.product.product_name %}.
|
||||
|
||||
@@ -10,9 +10,9 @@ redirect_from:
|
||||
- /code-security/secure-coding/configuring-codeql-code-scanning-in-your-ci-system
|
||||
- /code-security/secure-coding/configuring-codeql-runner-in-your-ci-system
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -147,7 +147,7 @@ Initializes the {% data variables.product.prodname_codeql_runner %} and creates
|
||||
| Flag | Required | Input value |
|
||||
| ---- |:--------:| ----------- |
|
||||
| `--repository` | ✓ | Name of the repository to initialize. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% if currentVersion ver_lt "enterprise-server@3.1" %}
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% ifversion ghes < 3.1 %}
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |{% else %}
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |{% endif %}
|
||||
| `--languages` | | Comma-separated list of languages to analyze. By default, the {% data variables.product.prodname_codeql_runner %} detects and analyzes all supported languages in the repository. |
|
||||
@@ -182,14 +182,14 @@ Analyzes the code in the {% data variables.product.prodname_codeql %} databases
|
||||
| `--repository` | ✓ | Name of the repository to analyze. |
|
||||
| `--commit` | ✓ | SHA of the commit to analyze. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
|
||||
| `--ref` | ✓ | Name of the reference to analyze, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% if currentVersion ver_lt "enterprise-server@3.1" %}
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% ifversion ghes < 3.1 %}
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |{% else %}
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |{% endif %}
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_name %}. |
|
||||
| `--output-dir` | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. |
|
||||
| `--ram` | | Amount of memory to use when running queries. The default is to use all available memory. |
|
||||
| <nobr>`--no-add-snippets`</nobr> | | None. Excludes code snippets from the SARIF output. |{% if currentVersion == "free-pro-team@latest" %}
|
||||
| <nobr>`--no-add-snippets`</nobr> | | None. Excludes code snippets from the SARIF output. |{% ifversion fpt %}
|
||||
| <nobr>`--category`<nobr> | | Category to include in the SARIF results file for this analysis. A category can be used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code. This value will appear in the `<run>.automationDetails.id` property in SARIF v2.1.0. |{% endif %}
|
||||
| `--threads` | | Number of threads to use when running queries. The default is to use all available cores. |
|
||||
| `--temp-dir` | | Directory where temporary files are stored. The default is `./codeql-runner`. |
|
||||
@@ -212,7 +212,7 @@ Uploads SARIF files to {% data variables.product.product_name %}.
|
||||
| `--repository` | ✓ | Name of the repository that was analyzed. |
|
||||
| `--commit` | ✓ | SHA of the commit that was analyzed. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. |
|
||||
| `--ref` | ✓ | Name of the reference that was analyzed, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. |
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% if currentVersion ver_lt "enterprise-server@3.1" %}
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% ifversion ghes < 3.1 %}
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |{% else %}
|
||||
| <nobr>`--github-auth-stdin`</nobr> | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |{% endif %}
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
|
||||
@@ -6,9 +6,9 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/using-codeql-code-scanning-with-your-existing-ci-system
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
|
||||
@@ -5,9 +5,9 @@ intro: 'You can install the {% data variables.product.prodname_codeql_cli %} and
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
miniTocMaxHeadingLevel: 3
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.1'
|
||||
github-ae: 'next'
|
||||
fpt: '*'
|
||||
ghes: '>=3.1'
|
||||
ghae: next
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -49,7 +49,7 @@ You should always use the {% data variables.product.prodname_codeql %} bundle as
|
||||
You need to make the full contents of the {% data variables.product.prodname_codeql_cli %} bundle available to every CI server that you want to run CodeQL {% data variables.product.prodname_code_scanning %} analysis on. For example, you might configure each server to copy the bundle from a central, internal location and extract it. Alternatively, you could use the REST API to get the bundle directly from {% data variables.product.prodname_dotcom %}, ensuring that you benefit from the latest improvements to queries. Updates to the {% data variables.product.prodname_codeql_cli %} are released every 2-3 weeks. For example:
|
||||
|
||||
```shell
|
||||
$ wget https://{% if currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.gz
|
||||
$ wget https://{% ifversion fpt %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases/latest/download/codeql-bundle-linux64.tar.gz
|
||||
$ tar -xvzf ../codeql-bundle-linux64.tar.gz
|
||||
```
|
||||
|
||||
|
||||
@@ -9,9 +9,9 @@ redirect_from:
|
||||
- /code-security/secure-coding/running-codeql-code-scanning-in-your-ci-system
|
||||
- /code-security/secure-coding/running-codeql-runner-in-your-ci-system
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
@@ -34,7 +34,7 @@ topics:
|
||||
|
||||
The {% data variables.product.prodname_codeql_runner %} is a tool you can use to run {% data variables.product.prodname_code_scanning %} on code that you're processing in a third-party continuous integration (CI) system. {% data reusables.code-scanning.about-code-scanning %} For information, see "[About {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/about-code-scanning)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" or currentVersion == "github-ae@next" %}
|
||||
{% ifversion fpt or ghes > 3.0 or ghae-next %}
|
||||
In many cases it is easier to set up {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} using the {% data variables.product.prodname_codeql_cli %} directly in your CI system. The runner is more complex and less forgiving to set up than the CLI, and is recommended only if you need its capability to analyze multiple compiled languages with a single build, or to integrate with complex build processes. For more information, see "[About CodeQL code scanning in your CI system](/code-security/secure-coding/about-codeql-code-scanning-in-your-ci-system)".
|
||||
{% endif %}
|
||||
|
||||
@@ -45,12 +45,12 @@ The {% data variables.product.prodname_codeql_runner %} is a command-line tool t
|
||||
{% note %}
|
||||
|
||||
**Note:**
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
{% ifversion fpt %}
|
||||
* The {% data variables.product.prodname_codeql_runner %} uses the {% data variables.product.prodname_codeql %} CLI to analyze code and therefore has the same license conditions. It's free to use on public repositories that are maintained on {% data variables.product.prodname_dotcom_the_website %}, and available to use on private repositories that are owned by customers with an {% data variables.product.prodname_advanced_security %} license. For information, see "[{% data variables.product.product_name %} {% data variables.product.prodname_codeql %} Terms and Conditions](https://securitylab.github.com/tools/codeql/license)" and "[{% data variables.product.prodname_codeql %} CLI](https://codeql.github.com/docs/codeql-cli/)."
|
||||
{% else %}
|
||||
* The {% data variables.product.prodname_codeql_runner %} is available to customers with an {% data variables.product.prodname_advanced_security %} license.
|
||||
{% endif %}
|
||||
{% if currentVersion ver_lt "enterprise-server@3.1" or currentVersion == "github-ae@latest" %}
|
||||
{% ifversion ghes < 3.1 or ghae %}
|
||||
* The {% data variables.product.prodname_codeql_runner %} shouldn't be confused with the {% data variables.product.prodname_codeql %} CLI. The {% data variables.product.prodname_codeql %} CLI is a command-line interface that lets you create {% data variables.product.prodname_codeql %} databases for security research and run {% data variables.product.prodname_codeql %} queries.
|
||||
For more information, see "[{% data variables.product.prodname_codeql_cli %}](https://codeql.github.com/docs/codeql-cli/)."
|
||||
{% endif %}
|
||||
@@ -58,7 +58,7 @@ For more information, see "[{% data variables.product.prodname_codeql_cli %}](ht
|
||||
|
||||
## Downloading the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
You can download the {% data variables.product.prodname_codeql_runner %} from https://{% if currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
You can download the {% data variables.product.prodname_codeql_runner %} from https://{% ifversion fpt %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
|
||||
On Linux:
|
||||
|
||||
@@ -80,7 +80,7 @@ On Windows, the `codeql-runner-win.exe` file usually requires no change to permi
|
||||
Once you download the {% data variables.product.prodname_codeql_runner %} and verify that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. For example, you might configure each server to copy the runner from a central, internal location. Alternatively, you could use the REST API to get the runner directly from {% data variables.product.prodname_dotcom %}, for example:
|
||||
|
||||
```shell
|
||||
wget https://{% if currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases/latest/download/codeql-runner-linux
|
||||
wget https://{% ifversion fpt %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases/latest/download/codeql-runner-linux
|
||||
chmod +x codeql-runner-linux
|
||||
```
|
||||
|
||||
@@ -91,7 +91,7 @@ In addition to this, each CI server also needs:
|
||||
|
||||
The options for providing access to the {% data variables.product.prodname_codeql %} bundle are:
|
||||
|
||||
1. Allow the CI servers access to https://{% if currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action so that the {% data variables.product.prodname_codeql_runner %} can download the bundle automatically.
|
||||
1. Allow the CI servers access to https://{% ifversion fpt %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action so that the {% data variables.product.prodname_codeql_runner %} can download the bundle automatically.
|
||||
1. Manually download/extract the bundle, store it with other central resources, and use the <nobr>`--codeql-path`</nobr> flag to specify the location of the bundle in calls to initialize the {% data variables.product.prodname_codeql_runner %}.
|
||||
|
||||
## Calling the {% data variables.product.prodname_codeql_runner %}
|
||||
@@ -119,7 +119,7 @@ In this example, the server has access to download the {% data variables.product
|
||||
1. Move into the directory where the repository is checked out.
|
||||
1. Initialize the {% data variables.product.prodname_codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected.
|
||||
|
||||
{% if currentVersion ver_lt "enterprise-server@3.1" %}
|
||||
{% ifversion ghes < 3.1 %}
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo
|
||||
--github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN
|
||||
@@ -143,7 +143,7 @@ This example is similar to the previous example, however this time the repositor
|
||||
1. Check out the repository to analyze.
|
||||
1. Move into the directory where the repository is checked out.
|
||||
1. Initialize the {% data variables.product.prodname_codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected.
|
||||
{% if currentVersion ver_lt "enterprise-server@3.1" %}
|
||||
{% ifversion ghes < 3.1 %}
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo-2
|
||||
--github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN
|
||||
|
||||
@@ -9,9 +9,9 @@ redirect_from:
|
||||
- /code-security/secure-coding/troubleshooting-codeql-code-scanning-in-your-ci-system
|
||||
- /code-security/secure-coding/troubleshooting-codeql-runner-in-your-ci-system
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
fpt: '*'
|
||||
ghes: '>=3.0'
|
||||
ghae: '*'
|
||||
type: how_to
|
||||
topics:
|
||||
- Advanced Security
|
||||
|
||||
Reference in New Issue
Block a user