From 41c42293ff7ebfa04738cb44bf3d6a8c7722502c Mon Sep 17 00:00:00 2001 From: Courtney Wilson <77312589+cmwilson21@users.noreply.github.com> Date: Fri, 15 Apr 2022 12:52:17 +0000 Subject: [PATCH 1/4] created alerts-found-in-generated-code markdown file in resuables --- .../code-scanning/alerts-found-in-generated-code.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 data/reusables/code-scanning/alerts-found-in-generated-code.md diff --git a/data/reusables/code-scanning/alerts-found-in-generated-code.md b/data/reusables/code-scanning/alerts-found-in-generated-code.md new file mode 100644 index 000000000000..cf7444f5cf55 --- /dev/null +++ b/data/reusables/code-scanning/alerts-found-in-generated-code.md @@ -0,0 +1,5 @@ +For compiled languages like Java, C, C++, and C#, {% data variables.product.prodname_codeql %} analyzes all of the code which was built during the workflow run. To limit the amount of code being analyzed, build only the code which you wish to analyze by specifying your own build steps in a `run` block. You can combine specifying your own build steps with using the `paths` or `paths-ignore` filters on the `pull_request` and `push` events to ensure that your workflow only runs when specific code is changed. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore)." + +For languages like Go, JavaScript, Python, and TypeScript, that {% data variables.product.prodname_codeql %} analyzes without compiling the source code, you can specify additional configuration options to limit the amount of code to analyze. For more information, see "[Specifying directories to scan](/code-security/secure-coding/configuring-code-scanning#specifying-directories-to-scan)." + +If you split your analysis into multiple workflows as described above, we still recommend that you have at least one workflow which runs on a `schedule` which analyzes all of the code in your repository. Because {% data variables.product.prodname_codeql %} analyzes data flows between components, some complex security behaviors may only be detected on a complete build. \ No newline at end of file From b5705c50e439656dd2b487ae1da4149ad7e94315 Mon Sep 17 00:00:00 2001 From: Courtney Wilson <77312589+cmwilson21@users.noreply.github.com> Date: Fri, 15 Apr 2022 12:57:43 +0000 Subject: [PATCH 2/4] added reusable to Reduce the amount of code being analyzed section --- .../troubleshooting-the-codeql-workflow.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md b/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md index 67bc5728a9db..e62c484be508 100644 --- a/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md +++ b/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md @@ -191,11 +191,7 @@ The default {% data variables.product.prodname_codeql_workflow %} uses a build m Analysis time is typically proportional to the amount of code being analyzed. You can reduce the analysis time by reducing the amount of code being analyzed at once, for example, by excluding test code, or breaking analysis into multiple workflows that analyze only a subset of your code at a time. -For compiled languages like Java, C, C++, and C#, {% data variables.product.prodname_codeql %} analyzes all of the code which was built during the workflow run. To limit the amount of code being analyzed, build only the code which you wish to analyze by specifying your own build steps in a `run` block. You can combine specifying your own build steps with using the `paths` or `paths-ignore` filters on the `pull_request` and `push` events to ensure that your workflow only runs when specific code is changed. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore)." - -For languages like Go, JavaScript, Python, and TypeScript, that {% data variables.product.prodname_codeql %} analyzes without compiling the source code, you can specify additional configuration options to limit the amount of code to analyze. For more information, see "[Specifying directories to scan](/code-security/secure-coding/configuring-code-scanning#specifying-directories-to-scan)." - -If you split your analysis into multiple workflows as described above, we still recommend that you have at least one workflow which runs on a `schedule` which analyzes all of the code in your repository. Because {% data variables.product.prodname_codeql %} analyzes data flows between components, some complex security behaviors may only be detected on a complete build. +{% data reusables.code-scanning.alerts-found-in-generated-code %} ### Run only during a `schedule` event From 67b8bddf440aa3925c1b7808910a1962cd082417 Mon Sep 17 00:00:00 2001 From: Courtney Wilson <77312589+cmwilson21@users.noreply.github.com> Date: Fri, 15 Apr 2022 13:03:16 +0000 Subject: [PATCH 3/4] added Alerts foud in generated code section and added the reusable --- .../troubleshooting-the-codeql-workflow.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md b/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md index e62c484be508..eba13479e8a7 100644 --- a/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md +++ b/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md @@ -161,6 +161,11 @@ This uploads the database as an actions artifact that you can download to your l The artifact will contain an archived copy of the source files scanned by {% data variables.product.prodname_codeql %} called _src.zip_. If you compare the source code files in the repository and the files in _src.zip_, you can see which types of file are missing. Once you know what types of file are not being analyzed, it is easier to understand how you may need to change the workflow for {% data variables.product.prodname_codeql %} analysis. +## Alerts found in generated code + +{% data reusables.code-scanning.alerts-found-in-generated-code %} + + ## Extraction errors in the database The {% data variables.product.prodname_codeql %} team constantly works on critical extraction errors to make sure that all source files can be scanned. However, the {% data variables.product.prodname_codeql %} extractors do occasionally generate errors during database creation. {% data variables.product.prodname_codeql %} provides information about extraction errors and warnings generated during database creation in a log file. From fb076baa25f62714c011bbd25a203a9f4c47dd4b Mon Sep 17 00:00:00 2001 From: Courtney Wilson <77312589+cmwilson21@users.noreply.github.com> Date: Tue, 19 Apr 2022 19:17:34 +0000 Subject: [PATCH 4/4] removed line 5 from reusable and placed back in original location --- .../troubleshooting-the-codeql-workflow.md | 2 ++ .../reusables/code-scanning/alerts-found-in-generated-code.md | 4 +--- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md b/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md index eba13479e8a7..f3d53a8507cc 100644 --- a/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md +++ b/content/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow.md @@ -198,6 +198,8 @@ Analysis time is typically proportional to the amount of code being analyzed. Yo {% data reusables.code-scanning.alerts-found-in-generated-code %} +If you split your analysis into multiple workflows as described above, we still recommend that you have at least one workflow which runs on a `schedule` which analyzes all of the code in your repository. Because {% data variables.product.prodname_codeql %} analyzes data flows between components, some complex security behaviors may only be detected on a complete build. + ### Run only during a `schedule` event If your analysis is still too slow to be run during `push` or `pull_request` events, then you may want to only trigger analysis on the `schedule` event. For more information, see "[Events](/actions/learn-github-actions/introduction-to-github-actions#events)." diff --git a/data/reusables/code-scanning/alerts-found-in-generated-code.md b/data/reusables/code-scanning/alerts-found-in-generated-code.md index cf7444f5cf55..3e509e813d0c 100644 --- a/data/reusables/code-scanning/alerts-found-in-generated-code.md +++ b/data/reusables/code-scanning/alerts-found-in-generated-code.md @@ -1,5 +1,3 @@ For compiled languages like Java, C, C++, and C#, {% data variables.product.prodname_codeql %} analyzes all of the code which was built during the workflow run. To limit the amount of code being analyzed, build only the code which you wish to analyze by specifying your own build steps in a `run` block. You can combine specifying your own build steps with using the `paths` or `paths-ignore` filters on the `pull_request` and `push` events to ensure that your workflow only runs when specific code is changed. For more information, see "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore)." -For languages like Go, JavaScript, Python, and TypeScript, that {% data variables.product.prodname_codeql %} analyzes without compiling the source code, you can specify additional configuration options to limit the amount of code to analyze. For more information, see "[Specifying directories to scan](/code-security/secure-coding/configuring-code-scanning#specifying-directories-to-scan)." - -If you split your analysis into multiple workflows as described above, we still recommend that you have at least one workflow which runs on a `schedule` which analyzes all of the code in your repository. Because {% data variables.product.prodname_codeql %} analyzes data flows between components, some complex security behaviors may only be detected on a complete build. \ No newline at end of file +For languages like Go, JavaScript, Python, and TypeScript, that {% data variables.product.prodname_codeql %} analyzes without compiling the source code, you can specify additional configuration options to limit the amount of code to analyze. For more information, see "[Specifying directories to scan](/code-security/secure-coding/configuring-code-scanning#specifying-directories-to-scan)." \ No newline at end of file