Skip to content

Commit 2e80c74

Browse files
aeisenbergaeisenberg
authored
Merge pull request #1096 from github/aeisenberg/check-sarif-action
Add the check-sarif action
2 parents d2ab7a2 + 80ecdcd commit 2e80c74

27 files changed

+935
-96
lines changed

‎.github/check-sarif/action.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Check SARIF
2+
description: Checks a SARIF file to see if certain queries were run and others were not run.
3+
inputs:
4+
sarif-file:
5+
required: true
6+
description: The sarif file to check
7+
8+
queries-run:
9+
required: true
10+
description: |
11+
Comma separated list of query ids that should be included in this SARIF file.
12+
13+
queries-not-run:
14+
required: true
15+
description: |
16+
Comma separated list of query ids that should NOT be included in this SARIF file.
17+
18+
runs:
19+
using: node12
20+
main: index.js

‎.github/check-sarif/index.js‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
'use strict'
2+
3+
const core = require('@actions/core')
4+
const fs = require('fs')
5+
6+
const sarif = JSON.parse(fs.readFileSync(core.getInput('sarif-file'), 'utf8'))
7+
const rules = sarif.runs[0].tool.extensions.flatMap(ext => ext.rules || [])
8+
const ruleIds = rules.map(rule => rule.id)
9+
10+
// Check that all the expected queries ran
11+
const expectedQueriesRun = getQueryIdsInput('queries-run')
12+
const queriesThatShouldHaveRunButDidNot = expectedQueriesRun.filter(queryId => !ruleIds.includes(queryId))
13+
14+
if (queriesThatShouldHaveRunButDidNot.length > 0) {
15+
core.setFailed(`The following queries were expected to run but did not: ${queriesThatShouldHaveRunButDidNot.join(', ')}`)
16+
}
17+
18+
// Check that all the unexpected queries did not run
19+
const expectedQueriesNotRun = getQueryIdsInput('queries-not-run')
20+
21+
const queriesThatShouldNotHaveRunButDid = expectedQueriesNotRun.filter(queryId => ruleIds.includes(queryId))
22+
23+
if (queriesThatShouldNotHaveRunButDid.length > 0) {
24+
core.setFailed(`The following queries were NOT expected to have run but did: ${queriesThatShouldNotHaveRunButDid.join(', ')}`)
25+
}
26+
27+
28+
core.startGroup('All queries run')
29+
rules.forEach(rule => {
30+
core.info(`${rule.id}: ${(rule.properties && rule.properties.name) || rule.name}`)
31+
})
32+
core.endGroup()
33+
34+
core.startGroup('Full SARIF')
35+
core.info(JSON.stringify(sarif, null, 2))
36+
core.endGroup()
37+
38+
function getQueryIdsInput(name) {
39+
return core.getInput(name)
40+
.split(',')
41+
.map(q => q.trim())
42+
.filter(q => q.length > 0)
43+
}

‎.github/query-filter-test/action.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Query Filter Test
2+
description: Runs a test of query filters using the check SARIF action
3+
inputs:
4+
sarif-file:
5+
required: true
6+
description: The SARIF file to check
7+
8+
queries-run:
9+
required: true
10+
description: |
11+
Comma separated list of query ids that should be included in this SARIF file.
12+
13+
queries-not-run:
14+
required: true
15+
description: |
16+
Comma separated list of query ids that should NOT be included in this SARIF file.
17+
18+
config-file:
19+
required: true
20+
description: |
21+
The location of the codeql configuration file to use.
22+
23+
tools:
24+
required: true
25+
description: |
26+
The url of codeql to use.
27+
28+
runs:
29+
using: composite
30+
steps:
31+
- uses: ./../action/init
32+
with:
33+
languages: javascript
34+
config-file: ./.github/codeql/codeql-config-query-filters1.yml
35+
tools: ${{ inputs.tools }}
36+
db-location: ${{ runner.temp }}/query-filter-test
37+
- uses: ./../action/analyze
38+
with:
39+
output: ${{ runner.temp }}/results
40+
upload-database: false
41+
upload: false
42+
env:
43+
TEST_MODE: "true"
44+
- name: Check SARIF
45+
uses: ./../action/.github/check-sarif
46+
with:
47+
sarif-file: ${{ inputs.sarif-file }}
48+
queries-run: ${{ inputs.queries-run}}
49+
queries-not-run: ${{ inputs.queries-not-run}}
50+
- name: Cleanup after test
51+
shell: bash
52+
run: rm -rf "$RUNNER_TEMP/results" "$RUNNER_TEMP//query-filter-test"

‎.github/workflows/expected-queries-runs.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Check queries that ran
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- releases/v1
8+
- releases/v2
9+
pull_request:
10+
types:
11+
- opened
12+
- synchronize
13+
- reopened
14+
- ready_for_review
15+
workflow_dispatch: {}
16+
17+
jobs:
18+
expected-queries:
19+
timeout-minutes: 45
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Check out repository
23+
uses: actions/checkout@v3
24+
- name: Prepare test
25+
id: prepare-test
26+
uses: ./.github/prepare-test
27+
with:
28+
version: latest
29+
- uses: ./../action/init
30+
with:
31+
languages: javascript
32+
tools: ${{ steps.prepare-test.outputs.tools-url }}
33+
- uses: ./../action/analyze
34+
with:
35+
output: ${{ runner.temp }}/results
36+
upload-database: false
37+
upload: false
38+
env:
39+
TEST_MODE: true
40+
41+
- name: Check Sarif
42+
uses: ./../action/.github/check-sarif
43+
with:
44+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
45+
queries-run: js/incomplete-hostname-regexp,js/path-injection
46+
queries-not-run: foo,bar

‎.github/workflows/query-filters.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Query filters tests
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- releases/v1
8+
- releases/v2
9+
pull_request:
10+
types:
11+
- opened
12+
- synchronize
13+
- reopened
14+
- ready_for_review
15+
workflow_dispatch: {}
16+
17+
jobs:
18+
expected-queries:
19+
timeout-minutes: 45
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Check out repository
23+
uses: actions/checkout@v3
24+
- name: Prepare test
25+
id: prepare-test
26+
uses: ./.github/prepare-test
27+
with:
28+
version: latest
29+
30+
- name: Check SARIF for default queries with Single include, Single exclude
31+
uses: ./../action/.github/query-filter-test
32+
with:
33+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
34+
queries-run: js/zipslip
35+
queries-not-run: js/path-injection
36+
config-file: ./.github/codeql/codeql-config-query-filters1.yml
37+
tools: ${{ steps.prepare-test.outputs.tools-url }}
38+
39+
- name: Check SARIF for query packs with Single include, Single exclude
40+
uses: ./../action/.github/query-filter-test
41+
with:
42+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
43+
queries-run: js/zipslip,javascript/example/empty-or-one-block
44+
queries-not-run: js/path-injection
45+
config-file: ./.github/codeql/codeql-config-query-filters2.yml
46+
tools: ${{ steps.prepare-test.outputs.tools-url }}
47+
48+
- name: Check SARIF for query packs and local queries with Single include, Single exclude
49+
uses: ./../action/.github/query-filter-test
50+
with:
51+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
52+
queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
53+
queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
54+
config-file: ./.github/codeql/codeql-config-query-filters3.yml
55+
tools: ${{ steps.prepare-test.outputs.tools-url }}

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## [UNRELEASED]
44

5-
No user facing changes.
5+
- Add the ability to filter queries from a code scanning run by using the `query-filters` option in the code scanning configuration file. [#1098](https://github.com/github/codeql-action/pull/1098)
66

77
## 2.1.12 - 01 Jun 2022
88

‎lib/analyze.js‎

Lines changed: 54 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)