initial commit of actions
This commit is contained in:
commit
949ece5785
44660 changed files with 12034344 additions and 0 deletions
|
|
@ -0,0 +1,16 @@
|
|||
name: "All-platform bundle"
|
||||
description: "Tests using an all-platform CodeQL Bundle"
|
||||
versions: ["nightly-latest"]
|
||||
operatingSystems: ["ubuntu"]
|
||||
useAllPlatformBundle: "true"
|
||||
steps:
|
||||
- id: init
|
||||
uses: ./../action/init
|
||||
with:
|
||||
# Swift is not supported on Ubuntu so we manually exclude it from the list here
|
||||
languages: cpp,csharp,go,java,javascript,python,ruby
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
name: "Analyze: 'ref' and 'sha' from inputs"
|
||||
description: "Checks that specifying 'ref' and 'sha' as inputs works"
|
||||
versions: ["default"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
languages: cpp,csharp,java,javascript,python
|
||||
config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
ref: 'refs/heads/main'
|
||||
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
name: "autobuild-action"
|
||||
description: "Tests that the C# autobuild action works"
|
||||
versions: ["linked"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: csharp
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/autobuild
|
||||
env:
|
||||
# Explicitly disable the CLR tracer.
|
||||
COR_ENABLE_PROFILING: ""
|
||||
COR_PROFILER: ""
|
||||
COR_PROFILER_PATH_64: ""
|
||||
CORECLR_ENABLE_PROFILING: ""
|
||||
CORECLR_PROFILER: ""
|
||||
CORECLR_PROFILER_PATH_64: ""
|
||||
- uses: ./../action/analyze
|
||||
- name: Check database
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/codeql_databases"
|
||||
if [[ ! -d csharp ]]; then
|
||||
echo "Did not find a C# database"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
name: "Autobuild direct tracing (custom working directory)"
|
||||
description: >
|
||||
An end-to-end integration test of a Java repository built using 'build-mode: autobuild',
|
||||
with direct tracing enabled and a custom working directory specified as the input to the
|
||||
autobuild Action.
|
||||
operatingSystems: ["ubuntu", "windows"]
|
||||
versions: ["linked", "nightly-latest"]
|
||||
env:
|
||||
CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
|
||||
steps:
|
||||
- name: Test setup
|
||||
shell: bash
|
||||
run: |
|
||||
# Make sure that Gradle build succeeds in autobuild-dir ...
|
||||
cp -a ../action/tests/java-repo autobuild-dir
|
||||
# ... and fails if attempted in the current directory
|
||||
echo > build.gradle
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
build-mode: autobuild
|
||||
languages: java
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Check that indirect tracing is disabled
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ ! -z "${CODEQL_RUNNER}" ]]; then
|
||||
echo "Expected indirect tracing to be disabled, but the" \
|
||||
"CODEQL_RUNNER environment variable is set."
|
||||
exit 1
|
||||
fi
|
||||
- uses: ./../action/autobuild
|
||||
with:
|
||||
working-directory: autobuild-dir
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
name: "Autobuild direct tracing"
|
||||
description: "An end-to-end integration test of a Java repository built using 'build-mode: autobuild', with direct tracing enabled"
|
||||
operatingSystems: ["ubuntu", "windows"]
|
||||
versions: ["linked", "nightly-latest"]
|
||||
env:
|
||||
CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
|
||||
steps:
|
||||
- name: Set up Java test repo configuration
|
||||
shell: bash
|
||||
run: |
|
||||
mv * .github ../action/tests/multi-language-repo/
|
||||
mv ../action/tests/multi-language-repo/.github/workflows .github
|
||||
mv ../action/tests/java-repo/* .
|
||||
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
build-mode: autobuild
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
languages: java
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Check that indirect tracing is disabled
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ ! -z "${CODEQL_RUNNER}" ]]; then
|
||||
echo "Expected indirect tracing to be disabled, but the" \
|
||||
"CODEQL_RUNNER environment variable is set."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
name: "Build mode autobuild"
|
||||
description: "An end-to-end integration test of a Java repository built using 'build-mode: autobuild'"
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["nightly-latest"]
|
||||
steps:
|
||||
- name: Set up Java test repo configuration
|
||||
run: |
|
||||
mv * .github ../action/tests/multi-language-repo/
|
||||
mv ../action/tests/multi-language-repo/.github/workflows .github
|
||||
mv ../action/tests/java-repo/* .
|
||||
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
build-mode: autobuild
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
languages: java
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Validate database build mode
|
||||
run: |
|
||||
metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml"
|
||||
build_mode=$(yq eval '.buildMode' "$metadata_path")
|
||||
if [[ "$build_mode" != "autobuild" ]]; then
|
||||
echo "Expected build mode to be 'autobuild' but was $build_mode"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
name: "Build mode manual"
|
||||
description: "An end-to-end integration test of a Java repository built using 'build-mode: manual'"
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["nightly-latest"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
build-mode: manual
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
languages: java
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Validate database build mode
|
||||
run: |
|
||||
metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml"
|
||||
build_mode=$(yq eval '.buildMode' "$metadata_path")
|
||||
if [[ "$build_mode" != "manual" ]]; then
|
||||
echo "Expected build mode to be 'manual' but was $build_mode"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
|
||||
- uses: ./../action/analyze
|
||||
27
github/codeql-action-v2/pr-checks/checks/build-mode-none.yml
Normal file
27
github/codeql-action-v2/pr-checks/checks/build-mode-none.yml
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
name: "Build mode none"
|
||||
description: "An end-to-end integration test of a Java repository built using 'build-mode: none'"
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["linked", "nightly-latest"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
build-mode: none
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
languages: java
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Validate database build mode
|
||||
run: |
|
||||
metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml"
|
||||
build_mode=$(yq eval '.buildMode' "$metadata_path")
|
||||
if [[ "$build_mode" != "none" ]]; then
|
||||
echo "Expected build mode to be 'none' but was $build_mode"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# The latest nightly supports omitting the autobuild Action when the build mode is specified.
|
||||
- uses: ./../action/autobuild
|
||||
if: matrix.version != 'nightly-latest'
|
||||
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
name: "Build mode rollback"
|
||||
description: "The build mode is rolled back from none to autobuild when the relevant feature flag is enabled."
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["nightly-latest"]
|
||||
env:
|
||||
CODEQL_ACTION_DISABLE_JAVA_BUILDLESS: true
|
||||
steps:
|
||||
- name: Set up Java test repo configuration
|
||||
run: |
|
||||
mv * .github ../action/tests/multi-language-repo/
|
||||
mv ../action/tests/multi-language-repo/.github/workflows .github
|
||||
mv ../action/tests/java-repo/* .
|
||||
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
build-mode: none
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
languages: java
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Validate database build mode
|
||||
run: |
|
||||
metadata_path="$RUNNER_TEMP/customDbLocation/java/codeql-database.yml"
|
||||
build_mode=$(yq eval '.buildMode' "$metadata_path")
|
||||
if [[ "$build_mode" != "autobuild" ]]; then
|
||||
echo "Expected build mode to be 'autobuild' but was $build_mode"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
name: "Clean up database cluster directory"
|
||||
description: "The database cluster directory is cleaned up if it is not empty."
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["linked"]
|
||||
steps:
|
||||
- name: Add a file to the database cluster directory
|
||||
run: |
|
||||
mkdir -p "${{ runner.temp }}/customDbLocation/javascript"
|
||||
touch "${{ runner.temp }}/customDbLocation/javascript/a-file-to-clean-up.txt"
|
||||
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
build-mode: none
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Validate file cleaned up
|
||||
run: |
|
||||
if [[ -f "${{ runner.temp }}/customDbLocation/javascript/a-file-to-clean-up.txt" ]]; then
|
||||
echo "File was not cleaned up"
|
||||
exit 1
|
||||
fi
|
||||
echo "File was cleaned up"
|
||||
45
github/codeql-action-v2/pr-checks/checks/config-export.yml
Normal file
45
github/codeql-action-v2/pr-checks/checks/config-export.yml
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
name: "Config export"
|
||||
description: "Tests that the code scanning configuration file is exported to SARIF correctly."
|
||||
versions: ["linked", "nightly-latest"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: javascript
|
||||
queries: security-extended
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
- name: Upload SARIF
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
|
||||
path: "${{ runner.temp }}/results/javascript.sarif"
|
||||
retention-days: 7
|
||||
- name: Check config properties appear in SARIF
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
|
||||
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
|
||||
const run = sarif.runs[0];
|
||||
const configSummary = run.properties.codeqlConfigSummary;
|
||||
|
||||
if (configSummary === undefined) {
|
||||
core.setFailed('`codeqlConfigSummary` property not found in the SARIF run property bag.');
|
||||
}
|
||||
if (configSummary.disableDefaultQueries !== false) {
|
||||
core.setFailed('`disableDefaultQueries` property incorrect: expected false, got ' +
|
||||
`${JSON.stringify(configSummary.disableDefaultQueries)}.`);
|
||||
}
|
||||
const expectedQueries = [{ type: 'builtinSuite', uses: 'security-extended' }];
|
||||
// Use JSON.stringify to deep-equal the arrays.
|
||||
if (JSON.stringify(configSummary.queries) !== JSON.stringify(expectedQueries)) {
|
||||
core.setFailed(`\`queries\` property incorrect: expected ${JSON.stringify(expectedQueries)}, got ` +
|
||||
`${JSON.stringify(configSummary.queries)}.`);
|
||||
}
|
||||
core.info('Finished config export tests.');
|
||||
33
github/codeql-action-v2/pr-checks/checks/config-input.yml
Normal file
33
github/codeql-action-v2/pr-checks/checks/config-input.yml
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
name: "Config input"
|
||||
description: "Tests specifying configuration using the config input"
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["linked"]
|
||||
steps:
|
||||
- name: Copy queries into workspace
|
||||
run: |
|
||||
cp -a ../action/queries .
|
||||
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
languages: javascript
|
||||
build-mode: none
|
||||
config: |
|
||||
disable-default-queries: true
|
||||
queries:
|
||||
- name: Run custom query
|
||||
uses: ./queries/default-setup-environment-variables.ql
|
||||
paths-ignore:
|
||||
- tests
|
||||
- lib
|
||||
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: ${{ runner.temp }}/results
|
||||
|
||||
- name: Check SARIF
|
||||
uses: ./../action/.github/actions/check-sarif
|
||||
with:
|
||||
sarif-file: ${{ runner.temp }}/results/javascript.sarif
|
||||
queries-run: javascript/codeql-action/default-setup-env-vars
|
||||
queries-not-run: javascript/codeql-action/default-setup-context-properties
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
name: "C/C++: disabling autoinstalling dependencies (Linux)"
|
||||
description: "Checks that running C/C++ autobuild with autoinstalling dependencies explicitly disabled works"
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with CLIs < 2.15.0
|
||||
env:
|
||||
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
|
||||
steps:
|
||||
- name: Test setup
|
||||
shell: bash
|
||||
run: |
|
||||
cp -a ../action/tests/cpp-autobuild autobuild-dir
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: cpp
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/autobuild
|
||||
with:
|
||||
working-directory: autobuild-dir
|
||||
env:
|
||||
CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: false
|
||||
- shell: bash
|
||||
run: |
|
||||
if ls /usr/bin/errno; then
|
||||
echo "C/C++ autobuild installed errno, but it should not have since auto-install dependencies is disabled."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
name: "C/C++: autoinstalling dependencies is skipped (macOS)"
|
||||
description: "Checks that running C/C++ autobuild with autoinstalling dependencies explicitly enabled is a no-op on macOS"
|
||||
operatingSystems: ["macos"]
|
||||
versions: ["nightly-latest"] # This is not released yet, will come with 2.15.2
|
||||
env:
|
||||
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
|
||||
steps:
|
||||
- name: Test setup
|
||||
shell: bash
|
||||
run: |
|
||||
cp -a ../action/tests/cpp-autobuild autobuild-dir
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: cpp
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/autobuild
|
||||
with:
|
||||
working-directory: autobuild-dir
|
||||
env:
|
||||
CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
|
||||
- shell: bash
|
||||
run: |
|
||||
if ! ls /usr/bin/errno; then
|
||||
echo "As expected, CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES is a no-op on macOS"
|
||||
else
|
||||
echo "CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES should not have had any effect on macOS"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
name: "C/C++: autoinstalling dependencies (Linux)"
|
||||
description: "Checks that running C/C++ autobuild with autoinstalling dependencies works"
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with CLIs < 2.15.0
|
||||
env:
|
||||
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
|
||||
steps:
|
||||
- name: Test setup
|
||||
shell: bash
|
||||
run: |
|
||||
cp -a ../action/tests/cpp-autobuild autobuild-dir
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: cpp
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/autobuild
|
||||
with:
|
||||
working-directory: autobuild-dir
|
||||
env:
|
||||
CODEQL_EXTRACTOR_CPP_AUTOINSTALL_DEPENDENCIES: true
|
||||
- shell: bash
|
||||
run: |
|
||||
if ! ls /usr/bin/errno; then
|
||||
echo "Did not autoinstall errno"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
name: "Diagnostic export"
|
||||
description: "Tests that manually added diagnostics are correctly exported to SARIF."
|
||||
versions: ["linked", "nightly-latest"]
|
||||
env:
|
||||
CODEQL_ACTION_EXPORT_DIAGNOSTICS: true
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Add test diagnostics
|
||||
shell: bash
|
||||
env:
|
||||
CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
|
||||
run: |
|
||||
"$CODEQL_PATH" database add-diagnostic \
|
||||
"$RUNNER_TEMP/codeql_databases/javascript" \
|
||||
--file-path /path/to/file \
|
||||
--plaintext-message "Plaintext message" \
|
||||
--source-id "lang/diagnostics/example" \
|
||||
--source-name "Diagnostic name" \
|
||||
--ready-for-status-page
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
- name: Upload SARIF
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
|
||||
path: "${{ runner.temp }}/results/javascript.sarif"
|
||||
retention-days: 7
|
||||
- name: Check diagnostics appear in SARIF
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
|
||||
function checkStatusPageNotification(n) {
|
||||
const expectedMessage = 'Plaintext message';
|
||||
if (n.message.text !== expectedMessage) {
|
||||
core.setFailed(`Expected the status page diagnostic to have the message '${expectedMessage}', but found '${n.message.text}'.`);
|
||||
}
|
||||
if (n.locations.length !== 1) {
|
||||
core.setFailed(`Expected the status page diagnostic to have exactly 1 location, but found ${n.locations.length}.`);
|
||||
}
|
||||
}
|
||||
|
||||
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
|
||||
const run = sarif.runs[0];
|
||||
|
||||
const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
|
||||
const statusPageNotifications = toolExecutionNotifications.filter(n =>
|
||||
n.descriptor.id === 'lang/diagnostics/example' && n.properties?.visibility?.statusPage
|
||||
);
|
||||
if (statusPageNotifications.length !== 1) {
|
||||
core.setFailed(
|
||||
'Expected exactly one status page reporting descriptor for this diagnostic in the ' +
|
||||
`'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
|
||||
`${statusPageNotifications.length}. All notification reporting descriptors: ` +
|
||||
`${JSON.stringify(toolExecutionNotifications)}.`
|
||||
);
|
||||
}
|
||||
checkStatusPageNotification(statusPageNotifications[0]);
|
||||
|
||||
const notifications = run.tool.driver.notifications;
|
||||
const diagnosticNotification = notifications.filter(n =>
|
||||
n.id === 'lang/diagnostics/example' && n.name === 'lang/diagnostics/example' &&
|
||||
n.fullDescription.text === 'Diagnostic name'
|
||||
);
|
||||
if (diagnosticNotification.length !== 1) {
|
||||
core.setFailed(
|
||||
'Expected exactly one notification for this diagnostic in the ' +
|
||||
`'runs[].tool.driver.notifications[]' SARIF property, but found ` +
|
||||
`${diagnosticNotification.length}. All notifications: ` +
|
||||
`${JSON.stringify(notifications)}.`
|
||||
);
|
||||
}
|
||||
|
||||
core.info('Finished diagnostic export test');
|
||||
|
|
@ -0,0 +1,47 @@
|
|||
name: "Export file baseline information"
|
||||
description: "Tests that file baseline information is exported when the feature is enabled"
|
||||
versions: ["nightly-latest"]
|
||||
env:
|
||||
CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/.github/actions/setup-swift
|
||||
if: runner.os == 'macOS'
|
||||
with:
|
||||
codeql-path: ${{ steps.init.outputs.codeql-path }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
- name: Upload SARIF
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
|
||||
path: "${{ runner.temp }}/results/javascript.sarif"
|
||||
retention-days: 7
|
||||
- name: Check results
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/results"
|
||||
expected_baseline_languages="c csharp go java kotlin javascript python ruby"
|
||||
if [[ $RUNNER_OS == "macOS" ]]; then
|
||||
expected_baseline_languages+=" swift"
|
||||
fi
|
||||
|
||||
for lang in ${expected_baseline_languages}; do
|
||||
rule_name="cli/expected-extracted-files/${lang}"
|
||||
found_notification=$(jq --arg rule_name "${rule_name}" '[.runs[0].tool.driver.notifications |
|
||||
select(. != null) | flatten | .[].id] | any(. == $rule_name)' javascript.sarif)
|
||||
if [[ "${found_notification}" != "true" ]]; then
|
||||
echo "Expected SARIF output to contain notification '${rule_name}', but found no such notification."
|
||||
exit 1
|
||||
else
|
||||
echo "Found notification '${rule_name}'."
|
||||
fi
|
||||
done
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
name: "Extract directly to toolcache"
|
||||
description: "Extract the CodeQL bundle directly into the toolcache"
|
||||
versions:
|
||||
- linked
|
||||
operatingSystems:
|
||||
- macos
|
||||
- ubuntu
|
||||
- windows
|
||||
env:
|
||||
CODEQL_ACTION_EXTRACT_TOOLCACHE: true
|
||||
steps:
|
||||
- name: Remove CodeQL from toolcache
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
|
||||
fs.rmdirSync(codeqlPath, { recursive: true });
|
||||
- name: Install @actions/tool-cache
|
||||
run: npm install @actions/tool-cache
|
||||
- name: Check toolcache does not contain CodeQL
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const toolcache = require('@actions/tool-cache');
|
||||
const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
|
||||
if (allCodeqlVersions.length !== 0) {
|
||||
throw new Error(`CodeQL should not be found in the toolcache, but found ${allCodeqlVersions}`);
|
||||
}
|
||||
console.log('No versions of CodeQL found in the toolcache');
|
||||
- id: init
|
||||
uses: ./../action/init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: ${{ runner.temp }}/results
|
||||
upload-database: false
|
||||
- name: Check CodeQL is installed within the toolcache
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const toolcache = require('@actions/tool-cache');
|
||||
const allCodeqlVersions = toolcache.findAllVersions('CodeQL');
|
||||
console.log(`Found CodeQL versions: ${allCodeqlVersions}`);
|
||||
if (allCodeqlVersions.length === 0) {
|
||||
throw new Error('CodeQL not found in toolcache');
|
||||
}
|
||||
if (allCodeqlVersions.length > 1) {
|
||||
throw new Error('Multiple CodeQL versions found in toolcache');
|
||||
}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
name: "Extractor ram and threads options test"
|
||||
description: "Tests passing RAM and threads limits to extractors"
|
||||
versions: ["linked"]
|
||||
operatingSystems: ["ubuntu"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: java
|
||||
ram: 230
|
||||
threads: 1
|
||||
- name: Assert Results
|
||||
shell: bash
|
||||
run: |
|
||||
if [ "${CODEQL_RAM}" != "230" ]; then
|
||||
echo "CODEQL_RAM is '${CODEQL_RAM}' instead of 230"
|
||||
exit 1
|
||||
fi
|
||||
if [ "${CODEQL_EXTRACTOR_JAVA_RAM}" != "230" ]; then
|
||||
echo "CODEQL_EXTRACTOR_JAVA_RAM is '${CODEQL_EXTRACTOR_JAVA_RAM}' instead of 230"
|
||||
exit 1
|
||||
fi
|
||||
if [ "${CODEQL_THREADS}" != "1" ]; then
|
||||
echo "CODEQL_THREADS is '${CODEQL_THREADS}' instead of 1"
|
||||
exit 1
|
||||
fi
|
||||
if [ "${CODEQL_EXTRACTOR_JAVA_THREADS}" != "1" ]; then
|
||||
echo "CODEQL_EXTRACTOR_JAVA_THREADS is '${CODEQL_EXTRACTOR_JAVA_THREADS}' instead of 1"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
name: "Go: Custom queries"
|
||||
description: "Checks that Go works in conjunction with a config file specifying custom queries"
|
||||
operatingSystems:
|
||||
- ubuntu
|
||||
versions:
|
||||
- linked
|
||||
- nightly-latest
|
||||
env:
|
||||
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ">=1.21.0"
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go
|
||||
config-file: ./.github/codeql/custom-queries.yml
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
name: "Go: diagnostic when Go is changed after init step"
|
||||
description: "Checks that we emit a diagnostic if Go is changed after the init step"
|
||||
# only Linux is affected
|
||||
operatingSystems: ["ubuntu"]
|
||||
# pinned to a version which does not support statically linked binaries for indirect tracing
|
||||
versions: ["default"]
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
# We need a Go version that ships with statically linked binaries on Linux
|
||||
go-version: ">=1.21.0"
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
# Deliberately change Go after the `init` step
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: "1.20"
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: go build main.go
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
- name: Check diagnostic appears in SARIF
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
|
||||
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
|
||||
const run = sarif.runs[0];
|
||||
|
||||
const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
|
||||
const statusPageNotifications = toolExecutionNotifications.filter(n =>
|
||||
n.descriptor.id === 'go/workflow/go-installed-after-codeql-init' && n.properties?.visibility?.statusPage
|
||||
);
|
||||
if (statusPageNotifications.length !== 1) {
|
||||
core.setFailed(
|
||||
'Expected exactly one status page reporting descriptor for this diagnostic in the ' +
|
||||
`'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
|
||||
`${statusPageNotifications.length}. All notification reporting descriptors: ` +
|
||||
`${JSON.stringify(toolExecutionNotifications)}.`
|
||||
);
|
||||
}
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
name: "Go: diagnostic when `file` is not installed"
|
||||
description: "Checks that we emit a diagnostic if the `file` program is not installed"
|
||||
# only Linux is affected
|
||||
operatingSystems: ["ubuntu"]
|
||||
# pinned to a version which does not support statically linked binaries for indirect tracing
|
||||
versions: ["default"]
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
# We need a Go version that ships with statically linked binaries on Linux
|
||||
go-version: ">=1.21.0"
|
||||
- name: Remove `file` program
|
||||
run: |
|
||||
echo $(which file)
|
||||
sudo rm -rf $(which file)
|
||||
echo $(which file)
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: go build main.go
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
- name: Check diagnostic appears in SARIF
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
SARIF_PATH: "${{ runner.temp }}/results/go.sarif"
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
|
||||
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
|
||||
const run = sarif.runs[0];
|
||||
|
||||
const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
|
||||
const statusPageNotifications = toolExecutionNotifications.filter(n =>
|
||||
n.descriptor.id === 'go/workflow/file-program-unavailable' && n.properties?.visibility?.statusPage
|
||||
);
|
||||
if (statusPageNotifications.length !== 1) {
|
||||
core.setFailed(
|
||||
'Expected exactly one status page reporting descriptor for this diagnostic in the ' +
|
||||
`'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
|
||||
`${statusPageNotifications.length}. All notification reporting descriptors: ` +
|
||||
`${JSON.stringify(toolExecutionNotifications)}.`
|
||||
);
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
name: "Go: workaround for indirect tracing"
|
||||
description: "Checks that our workaround for indirect tracing for Go 1.21+ on Linux works"
|
||||
# only Linux is affected
|
||||
operatingSystems: ["ubuntu"]
|
||||
# pinned to a version which does not support statically linked binaries for indirect tracing
|
||||
versions: ["default"]
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
# We need a Go version that ships with statically linked binaries on Linux
|
||||
go-version: ">=1.21.0"
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: go build main.go
|
||||
- uses: ./../action/analyze
|
||||
- shell: bash
|
||||
run: |
|
||||
if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then
|
||||
echo "Expected the workaround for indirect tracing of static binaries to trigger, but the" \
|
||||
"CODEQL_ACTION_GO_BINARY environment variable is not set."
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! -f "${CODEQL_ACTION_GO_BINARY}" ]]; then
|
||||
echo "CODEQL_ACTION_GO_BINARY is set, but the corresponding script does not exist."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
# Once we start running Bash 4.2 in all environments, we can replace the
|
||||
# `! -z` flag with the more elegant `-v` which confirms that the variable
|
||||
# is actually unset and not potentially set to a blank value.
|
||||
if [[ ! -z "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" ]]; then
|
||||
echo "Expected the Go autobuilder not to be run, but the" \
|
||||
"CODEQL_ACTION_DID_AUTOBUILD_GOLANG environment variable was set."
|
||||
exit 1
|
||||
fi
|
||||
cd "$RUNNER_TEMP/codeql_databases"
|
||||
if [[ ! -d go ]]; then
|
||||
echo "Did not find a Go database"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
name: "Go: tracing with autobuilder step"
|
||||
description: "Checks that Go tracing works when using an autobuilder step"
|
||||
operatingSystems: ["ubuntu", "macos"]
|
||||
env:
|
||||
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: "~1.23.0"
|
||||
# to avoid potentially misleading autobuilder results where we expect it to download
|
||||
# dependencies successfully, but they actually come from a warm cache
|
||||
cache: false
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/autobuild
|
||||
- uses: ./../action/analyze
|
||||
- shell: bash
|
||||
run: |
|
||||
if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
|
||||
echo "Expected the Go autobuilder to be run, but the" \
|
||||
"CODEQL_ACTION_DID_AUTOBUILD_GOLANG environment variable was not true."
|
||||
exit 1
|
||||
fi
|
||||
cd "$RUNNER_TEMP/codeql_databases"
|
||||
if [[ ! -d go ]]; then
|
||||
echo "Did not find a Go database"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
name: "Go: tracing with custom build steps"
|
||||
description: "Checks that Go tracing traces the build when using custom build steps"
|
||||
operatingSystems: ["ubuntu", "macos"]
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: "~1.23.0"
|
||||
# to avoid potentially misleading autobuilder results where we expect it to download
|
||||
# dependencies successfully, but they actually come from a warm cache
|
||||
cache: false
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: go build main.go
|
||||
- uses: ./../action/analyze
|
||||
- shell: bash
|
||||
run: |
|
||||
# Once we start running Bash 4.2 in all environments, we can replace the
|
||||
# `! -z` flag with the more elegant `-v` which confirms that the variable
|
||||
# is actually unset and not potentially set to a blank value.
|
||||
if [[ ! -z "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" ]]; then
|
||||
echo "Expected the Go autobuilder not to be run, but the" \
|
||||
"CODEQL_ACTION_DID_AUTOBUILD_GOLANG environment variable was set."
|
||||
exit 1
|
||||
fi
|
||||
cd "$RUNNER_TEMP/codeql_databases"
|
||||
if [[ ! -d go ]]; then
|
||||
echo "Did not find a Go database"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
name: "Go: tracing with legacy workflow"
|
||||
description: "Checks that we run the autobuilder in legacy workflows with neither an autobuild step nor manual build steps"
|
||||
operatingSystems: ["ubuntu", "macos"]
|
||||
env:
|
||||
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: "~1.23.0"
|
||||
# to avoid potentially misleading autobuilder results where we expect it to download
|
||||
# dependencies successfully, but they actually come from a warm cache
|
||||
cache: false
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
- shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/codeql_databases"
|
||||
if [[ ! -d go ]]; then
|
||||
echo "Did not find a Go database"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
# A test for running the init command with a registries block.
|
||||
# This test does _not_ validate that the action can authenticate
|
||||
# against multiple registries. All it does is validate that the
|
||||
# basic mechanics of multi-registry auth is working.
|
||||
name: "Packaging: Download using registries"
|
||||
description: "Checks that specifying a registries block and associated auth works as expected"
|
||||
versions: [
|
||||
# This feature is not compatible with older CLIs
|
||||
"default",
|
||||
"linked",
|
||||
"nightly-latest",
|
||||
]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
|
||||
steps:
|
||||
- name: Init with registries
|
||||
uses: ./../action/init
|
||||
with:
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
config-file: ./.github/codeql/codeql-config-registries.yml
|
||||
languages: javascript
|
||||
registries: |
|
||||
- url: "https://ghcr.io/v2/"
|
||||
packages: "*/*"
|
||||
token: "${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: Verify packages installed
|
||||
shell: bash
|
||||
run: |
|
||||
PRIVATE_PACK="$HOME/.codeql/packages/codeql-testing/private-pack"
|
||||
CODEQL_PACK1="$HOME/.codeql/packages/codeql-testing/codeql-pack1"
|
||||
|
||||
if [[ -d $PRIVATE_PACK ]]
|
||||
then
|
||||
echo "$PRIVATE_PACK was installed."
|
||||
else
|
||||
echo "::error $PRIVATE_PACK pack was not installed."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ -d $CODEQL_PACK1 ]]
|
||||
then
|
||||
echo "$CODEQL_PACK1 was installed."
|
||||
else
|
||||
echo "::error $CODEQL_PACK1 pack was not installed."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Verify qlconfig.yml file was created
|
||||
shell: bash
|
||||
run: |
|
||||
QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
|
||||
echo "Expected qlconfig.yml file to be created at $QLCONFIG_PATH"
|
||||
if [[ -f $QLCONFIG_PATH ]]
|
||||
then
|
||||
echo "qlconfig.yml file was created."
|
||||
else
|
||||
echo "::error qlconfig.yml file was not created."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Verify contents of qlconfig.yml
|
||||
# yq is not available on windows
|
||||
if: runner.os != 'Windows'
|
||||
shell: bash
|
||||
run: |
|
||||
QLCONFIG_PATH=$RUNNER_TEMP/qlconfig.yml
|
||||
cat $QLCONFIG_PATH | yq -e '.registries[] | select(.url == "https://ghcr.io/v2/") | select(.packages == "*/*")'
|
||||
if [[ $? -eq 0 ]]
|
||||
then
|
||||
echo "Registry was added to qlconfig.yml file."
|
||||
else
|
||||
echo "::error Registry was not added to qlconfig.yml file."
|
||||
echo "Contents of qlconfig.yml file:"
|
||||
cat $QLCONFIG_PATH
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
name: "Custom source root"
|
||||
description: "Checks that the argument specifying a non-default source root works"
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
|
||||
operatingSystems: ["ubuntu"]
|
||||
steps:
|
||||
- name: Move codeql-action
|
||||
shell: bash
|
||||
run: |
|
||||
mkdir ../new-source-root
|
||||
mv * ../new-source-root
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: javascript
|
||||
source-root: ../new-source-root
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
skip-queries: true
|
||||
- name: Assert database exists
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/codeql_databases"
|
||||
if [[ ! -d javascript ]]; then
|
||||
echo "Did not find a JavaScript database"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
name: "Job run UUID added to SARIF"
|
||||
description: "Tests that the job run UUID is added to the SARIF output"
|
||||
operatingSystems: ["ubuntu"]
|
||||
versions: ["nightly-latest"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
- name: Upload SARIF
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
|
||||
path: "${{ runner.temp }}/results/javascript.sarif"
|
||||
retention-days: 7
|
||||
- name: Check results
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/results"
|
||||
actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif)
|
||||
if [[ "$actual" != "$JOB_RUN_UUID" ]]; then
|
||||
echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'."
|
||||
exit 1
|
||||
else
|
||||
echo "Found job run UUID '$actual'."
|
||||
fi
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
name: "Language aliases"
|
||||
description: "Tests that language aliases are resolved correctly"
|
||||
versions: ["linked"]
|
||||
operatingSystems: ["ubuntu"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: C#,java-kotlin,swift,typescript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: "Check languages"
|
||||
run: |
|
||||
expected_languages="csharp,java,swift,javascript"
|
||||
actual_languages=$(jq -r '.languages | join(",")' "$RUNNER_TEMP"/config)
|
||||
|
||||
if [ "$expected_languages" != "$actual_languages" ]; then
|
||||
echo "Resolved languages did not match expected list. " \
|
||||
"Expected languages: $expected_languages. Actual languages: $actual_languages."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
name: "Multi-language repository"
|
||||
description: "An end-to-end integration test of a multi-language repository using automatic language detection for macOS"
|
||||
operatingSystems: ["macos", "ubuntu"]
|
||||
steps:
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: ">=1.21.0"
|
||||
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
db-location: "${{ runner.temp }}/customDbLocation"
|
||||
languages: ${{ runner.os == 'Linux' && 'cpp,csharp,go,java,javascript,python,ruby' || '' }}
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- uses: ./../action/.github/actions/setup-swift
|
||||
if: runner.os == 'macOS'
|
||||
with:
|
||||
codeql-path: ${{ steps.init.outputs.codeql-path }}
|
||||
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
|
||||
- uses: ./../action/analyze
|
||||
id: analysis
|
||||
with:
|
||||
upload-database: false
|
||||
|
||||
- name: Check language autodetect for all languages excluding Swift
|
||||
shell: bash
|
||||
run: |
|
||||
CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
|
||||
if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for CPP, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
CSHARP_DB=${{ fromJson(steps.analysis.outputs.db-locations).csharp }}
|
||||
if [[ ! -d $CSHARP_DB ]] || [[ ! $CSHARP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for C Sharp, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
GO_DB=${{ fromJson(steps.analysis.outputs.db-locations).go }}
|
||||
if [[ ! -d $GO_DB ]] || [[ ! $GO_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for Go, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
JAVA_DB=${{ fromJson(steps.analysis.outputs.db-locations).java }}
|
||||
if [[ ! -d $JAVA_DB ]] || [[ ! $JAVA_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for Java, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
JAVASCRIPT_DB=${{ fromJson(steps.analysis.outputs.db-locations).javascript }}
|
||||
if [[ ! -d $JAVASCRIPT_DB ]] || [[ ! $JAVASCRIPT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for Javascript, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
PYTHON_DB=${{ fromJson(steps.analysis.outputs.db-locations).python }}
|
||||
if [[ ! -d $PYTHON_DB ]] || [[ ! $PYTHON_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for Python, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
RUBY_DB=${{ fromJson(steps.analysis.outputs.db-locations).ruby }}
|
||||
if [[ ! -d $RUBY_DB ]] || [[ ! $RUBY_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for Ruby, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check language autodetect for Swift on macOS
|
||||
if: runner.os == 'macOS'
|
||||
shell: bash
|
||||
run: |
|
||||
SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
|
||||
if [[ ! -d $SWIFT_DB ]] || [[ ! $SWIFT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
|
||||
echo "Did not create a database for Swift, or created it in the wrong location."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
name: "Packaging: Config and input passed to the CLI"
|
||||
description: "Checks that specifying packages using a combination of a config file and input to the Action works"
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
config-file: ".github/codeql/codeql-config-packaging3.yml"
|
||||
packs: +codeql-testing/codeql-pack1@1.0.0
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
|
||||
- name: Check results
|
||||
uses: ./../action/.github/actions/check-sarif
|
||||
with:
|
||||
sarif-file: ${{ runner.temp }}/results/javascript.sarif
|
||||
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
|
||||
queries-not-run: foo,bar
|
||||
|
||||
- name: Assert Results
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/results"
|
||||
# We should have 4 hits from these rules
|
||||
EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/other-query-block javascript/example/two-block"
|
||||
|
||||
# use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
|
||||
RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n\r" " " | xargs)"
|
||||
echo "Found matching rules '$RULES'"
|
||||
if [ "$RULES" != "$EXPECTED_RULES" ]; then
|
||||
echo "Did not match expected rules '$EXPECTED_RULES'."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
name: "Packaging: Config and input"
|
||||
description: "Checks that specifying packages using a combination of a config file and input to the Action works"
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
config-file: ".github/codeql/codeql-config-packaging3.yml"
|
||||
packs: +codeql-testing/codeql-pack1@1.0.0
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
|
||||
- name: Check results
|
||||
uses: ./../action/.github/actions/check-sarif
|
||||
with:
|
||||
sarif-file: ${{ runner.temp }}/results/javascript.sarif
|
||||
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
|
||||
queries-not-run: foo,bar
|
||||
|
||||
- name: Assert Results
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/results"
|
||||
# We should have 4 hits from these rules
|
||||
EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/other-query-block javascript/example/two-block"
|
||||
|
||||
# use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
|
||||
RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n\r" " " | xargs)"
|
||||
echo "Found matching rules '$RULES'"
|
||||
if [ "$RULES" != "$EXPECTED_RULES" ]; then
|
||||
echo "Did not match expected rules '$EXPECTED_RULES'."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
name: "Packaging: Config file"
|
||||
description: "Checks that specifying packages using only a config file works"
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
config-file: ".github/codeql/codeql-config-packaging.yml"
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
|
||||
- name: Check results
|
||||
uses: ./../action/.github/actions/check-sarif
|
||||
with:
|
||||
sarif-file: ${{ runner.temp }}/results/javascript.sarif
|
||||
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
|
||||
queries-not-run: foo,bar
|
||||
|
||||
- name: Assert Results
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/results"
|
||||
# We should have 4 hits from these rules
|
||||
EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/other-query-block javascript/example/two-block"
|
||||
|
||||
# use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
|
||||
RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n\r" " " | xargs)"
|
||||
echo "Found matching rules '$RULES'"
|
||||
if [ "$RULES" != "$EXPECTED_RULES" ]; then
|
||||
echo "Did not match expected rules '$EXPECTED_RULES'."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
name: "Packaging: Action input"
|
||||
description: "Checks that specifying packages using the input to the Action works"
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
config-file: ".github/codeql/codeql-config-packaging2.yml"
|
||||
languages: javascript
|
||||
packs: codeql-testing/codeql-pack1@1.0.0, codeql-testing/codeql-pack2, codeql-testing/codeql-pack3:other-query.ql
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
|
||||
- name: Check results
|
||||
uses: ./../action/.github/actions/check-sarif
|
||||
with:
|
||||
sarif-file: ${{ runner.temp }}/results/javascript.sarif
|
||||
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
|
||||
queries-not-run: foo,bar
|
||||
|
||||
- name: Assert Results
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/results"
|
||||
# We should have 4 hits from these rules
|
||||
EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/other-query-block javascript/example/two-block"
|
||||
|
||||
# use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
|
||||
RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n\r" " " | xargs)"
|
||||
echo "Found matching rules '$RULES'"
|
||||
if [ "$RULES" != "$EXPECTED_RULES" ]; then
|
||||
echo "Did not match expected rules '$EXPECTED_RULES'."
|
||||
exit 1
|
||||
fi
|
||||
17
github/codeql-action-v2/pr-checks/checks/remote-config.yml
Normal file
17
github/codeql-action-v2/pr-checks/checks/remote-config.yml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
name: "Remote config file"
|
||||
description: "Checks that specifying packages using only a config file works"
|
||||
operatingSystems:
|
||||
- ubuntu
|
||||
versions:
|
||||
- linked
|
||||
- nightly-latest
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
languages: cpp,csharp,java,javascript,python
|
||||
config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
name: "Resolve environment"
|
||||
description: "Tests that the resolve-environment action works for Go and JavaScript/TypeScript"
|
||||
versions: ["default", "linked", "nightly-latest"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: go,javascript-typescript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Resolve environment for Go
|
||||
uses: ./../action/resolve-environment
|
||||
id: resolve-environment-go
|
||||
with:
|
||||
language: go
|
||||
|
||||
- name: Fail if Go configuration missing
|
||||
if: (!fromJSON(steps.resolve-environment-go.outputs.environment).configuration.go)
|
||||
run: exit 1
|
||||
|
||||
- name: Resolve environment for JavaScript/TypeScript
|
||||
uses: ./../action/resolve-environment
|
||||
id: resolve-environment-js
|
||||
with:
|
||||
language: javascript-typescript
|
||||
|
||||
- name: Fail if JavaScript/TypeScript configuration present
|
||||
if: fromJSON(steps.resolve-environment-js.outputs.environment).configuration.javascript
|
||||
run: exit 1
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
name: "RuboCop multi-language"
|
||||
description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
|
||||
operatingSystems: ["ubuntu"]
|
||||
# This check doesn't use CodeQL, so the `version` matrix variable is unused.
|
||||
versions: ["default"]
|
||||
steps:
|
||||
- name: Set up Ruby
|
||||
uses: ruby/setup-ruby@v1
|
||||
with:
|
||||
ruby-version: 2.6
|
||||
- name: Install Code Scanning integration
|
||||
shell: bash
|
||||
run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
|
||||
- name: Install dependencies
|
||||
shell: bash
|
||||
run: bundle install
|
||||
- name: RuboCop run
|
||||
shell: bash
|
||||
run: |
|
||||
bash -c "
|
||||
bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
|
||||
[[ $? -ne 2 ]]
|
||||
"
|
||||
- uses: ./../action/upload-sarif
|
||||
with:
|
||||
sarif_file: rubocop.sarif
|
||||
21
github/codeql-action-v2/pr-checks/checks/ruby.yml
Normal file
21
github/codeql-action-v2/pr-checks/checks/ruby.yml
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
name: "Ruby analysis"
|
||||
description: "Tests creation of a Ruby database"
|
||||
versions: ["linked", "default", "nightly-latest"]
|
||||
operatingSystems: ["ubuntu", "macos"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: ruby
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
id: analysis
|
||||
with:
|
||||
upload-database: false
|
||||
- name: Check database
|
||||
shell: bash
|
||||
run: |
|
||||
RUBY_DB="${{ fromJson(steps.analysis.outputs.db-locations).ruby }}"
|
||||
if [[ ! -d "$RUBY_DB" ]]; then
|
||||
echo "Did not create a database for Ruby."
|
||||
exit 1
|
||||
fi
|
||||
45
github/codeql-action-v2/pr-checks/checks/split-workflow.yml
Normal file
45
github/codeql-action-v2/pr-checks/checks/split-workflow.yml
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
name: "Split workflow"
|
||||
description: "Tests a split-up workflow in which we first build a database and later analyze it"
|
||||
operatingSystems: ["ubuntu", "macos"]
|
||||
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
config-file: ".github/codeql/codeql-config-packaging3.yml"
|
||||
packs: +codeql-testing/codeql-pack1@1.0.0
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
skip-queries: true
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
|
||||
- name: Assert No Results
|
||||
shell: bash
|
||||
run: |
|
||||
if [ "$(ls -A $RUNNER_TEMP/results)" ]; then
|
||||
echo "Expected results directory to be empty after skipping query execution!"
|
||||
exit 1
|
||||
fi
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: "${{ runner.temp }}/results"
|
||||
upload-database: false
|
||||
- name: Assert Results
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/results"
|
||||
# We should have 4 hits from these rules
|
||||
EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/other-query-block javascript/example/two-block"
|
||||
|
||||
# use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
|
||||
RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n\r" " " | xargs)"
|
||||
echo "Found matching rules '$RULES'"
|
||||
if [ "$RULES" != "$EXPECTED_RULES" ]; then
|
||||
echo "Did not match expected rules '$EXPECTED_RULES'."
|
||||
exit 1
|
||||
fi
|
||||
25
github/codeql-action-v2/pr-checks/checks/start-proxy.yml
Normal file
25
github/codeql-action-v2/pr-checks/checks/start-proxy.yml
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
name: "Start proxy"
|
||||
description: "Tests that the proxy can be initialised on all platforms"
|
||||
operatingSystems: ["ubuntu", "macos", "windows"]
|
||||
versions: ["linked"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: csharp
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
|
||||
- name: Setup proxy for registries
|
||||
id: proxy
|
||||
uses: ./../action/start-proxy
|
||||
with:
|
||||
registry_secrets: '[{ "type": "nuget_feed", "url": "https://api.nuget.org/v3/index.json" }]'
|
||||
|
||||
- name: Print proxy outputs
|
||||
run: |
|
||||
echo "${{ steps.proxy.outputs.proxy_host }}"
|
||||
echo "${{ steps.proxy.outputs.proxy_port }}"
|
||||
echo "${{ steps.proxy.outputs.proxy_urls }}"
|
||||
|
||||
- name: Fail if proxy outputs are not set
|
||||
if: (!steps.proxy.outputs.proxy_host) || (!steps.proxy.outputs.proxy_port) || (!steps.proxy.outputs.proxy_ca_certificate) || (!steps.proxy.outputs.proxy_urls)
|
||||
run: exit 1
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
name: Submit SARIF after failure
|
||||
description: Check that a SARIF file is submitted for the workflow run if it fails
|
||||
versions: ["linked", "default", "nightly-latest"]
|
||||
operatingSystems: ["ubuntu"]
|
||||
|
||||
env:
|
||||
# Internal-only environment variable used to indicate that the post-init Action
|
||||
# should expect to upload a SARIF file for the failed run.
|
||||
CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
|
||||
# Make sure the uploading SARIF files feature is enabled.
|
||||
CODEQL_ACTION_UPLOAD_FAILED_SARIF: true
|
||||
# Upload the failed SARIF file as an integration test of the API endpoint.
|
||||
CODEQL_ACTION_TEST_MODE: false
|
||||
# Mark telemetry for this workflow so it can be treated separately.
|
||||
CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: ./init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- name: Fail
|
||||
# We want this job to pass if the Action correctly uploads the SARIF file for
|
||||
# the failed run.
|
||||
# Setting this step to continue on error means that it is marked as completing
|
||||
# successfully, so will not fail the job.
|
||||
continue-on-error: true
|
||||
run: exit 1
|
||||
- uses: ./analyze
|
||||
# In a real workflow, this step wouldn't run. Since we used `continue-on-error`
|
||||
# above, we manually disable it with an `if` condition.
|
||||
if: false
|
||||
with:
|
||||
category: "/test-codeql-version:${{ matrix.version }}"
|
||||
31
github/codeql-action-v2/pr-checks/checks/swift-autobuild.yml
Normal file
31
github/codeql-action-v2/pr-checks/checks/swift-autobuild.yml
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
name: "Swift analysis using autobuild"
|
||||
description: "Tests creation of a Swift database using autobuild"
|
||||
versions: ["nightly-latest"]
|
||||
operatingSystems: ["macos"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
languages: swift
|
||||
build-mode: autobuild
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/.github/actions/setup-swift
|
||||
with:
|
||||
codeql-path: ${{steps.init.outputs.codeql-path}}
|
||||
- name: Check working directory
|
||||
shell: bash
|
||||
run: pwd
|
||||
- uses: ./../action/autobuild
|
||||
timeout-minutes: 30
|
||||
- uses: ./../action/analyze
|
||||
id: analysis
|
||||
with:
|
||||
upload-database: false
|
||||
- name: Check database
|
||||
shell: bash
|
||||
run: |
|
||||
SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
|
||||
if [[ ! -d "$SWIFT_DB" ]]; then
|
||||
echo "Did not create a database for Swift."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
name: "Swift analysis using a custom build command"
|
||||
description: "Tests creation of a Swift database using custom build"
|
||||
versions: ["linked", "default", "nightly-latest"]
|
||||
operatingSystems: ["macos"]
|
||||
env:
|
||||
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
languages: swift
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/.github/actions/setup-swift
|
||||
with:
|
||||
codeql-path: ${{steps.init.outputs.codeql-path}}
|
||||
- name: Check working directory
|
||||
shell: bash
|
||||
run: pwd
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
id: analysis
|
||||
with:
|
||||
upload-database: false
|
||||
- name: Check database
|
||||
shell: bash
|
||||
run: |
|
||||
SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
|
||||
if [[ ! -d "$SWIFT_DB" ]]; then
|
||||
echo "Did not create a database for Swift."
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
name: "Autobuild working directory"
|
||||
description: "Tests working-directory input of autobuild action"
|
||||
versions: ["linked"]
|
||||
operatingSystems: ["ubuntu"]
|
||||
steps:
|
||||
- name: Test setup
|
||||
shell: bash
|
||||
run: |
|
||||
# Make sure that Gradle build succeeds in autobuild-dir ...
|
||||
cp -a ../action/tests/java-repo autobuild-dir
|
||||
# ... and fails if attempted in the current directory
|
||||
echo > build.gradle
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: java
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/autobuild
|
||||
with:
|
||||
working-directory: autobuild-dir
|
||||
- uses: ./../action/analyze
|
||||
- name: Check database
|
||||
shell: bash
|
||||
run: |
|
||||
cd "$RUNNER_TEMP/codeql_databases"
|
||||
if [[ ! -d java ]]; then
|
||||
echo "Did not find a Java database"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
name: "Local CodeQL bundle"
|
||||
description: "Tests using a CodeQL bundle from a local file rather than a URL"
|
||||
versions: ["nightly-latest"]
|
||||
operatingSystems: ["ubuntu"]
|
||||
steps:
|
||||
- name: Fetch a CodeQL bundle
|
||||
shell: bash
|
||||
env:
|
||||
CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
run: |
|
||||
wget "$CODEQL_URL"
|
||||
- id: init
|
||||
uses: ./../action/init
|
||||
with:
|
||||
# Swift is not supported on Ubuntu so we manually exclude it from the list here
|
||||
languages: cpp,csharp,go,java,javascript,python,ruby
|
||||
tools: ./codeql-bundle-linux64.tar.zst
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
32
github/codeql-action-v2/pr-checks/checks/test-proxy.yml
Normal file
32
github/codeql-action-v2/pr-checks/checks/test-proxy.yml
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
name: "Proxy test"
|
||||
description: "Tests using a proxy specified by the https_proxy environment variable"
|
||||
versions: ["linked", "nightly-latest"]
|
||||
operatingSystems: ["ubuntu"]
|
||||
container:
|
||||
image: ubuntu:22.04
|
||||
container-init-steps:
|
||||
# These steps are required to initialise the `gh` cli in a container that doesn't
|
||||
# come pre-installed with it. The reason for that is that this is later
|
||||
# needed by the `prepare-test` workflow to find the latest release of CodeQL.
|
||||
name: Set up GitHub CLI
|
||||
run: |
|
||||
apt update
|
||||
apt install -y curl libreadline8 gnupg2 software-properties-common zstd
|
||||
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
|
||||
apt-key add /usr/share/keyrings/githubcli-archive-keyring.gpg
|
||||
apt-add-repository https://cli.github.com/packages
|
||||
apt install -y gh
|
||||
env: {}
|
||||
services:
|
||||
squid-proxy:
|
||||
image: ubuntu/squid:latest
|
||||
ports:
|
||||
- 3128:3128
|
||||
env:
|
||||
https_proxy: http://squid-proxy:3128
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
name: "Test unsetting environment variables"
|
||||
description: "An end-to-end integration test that unsets some environment variables"
|
||||
operatingSystems:
|
||||
- ubuntu
|
||||
versions:
|
||||
- linked
|
||||
- nightly-latest
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
id: init
|
||||
with:
|
||||
db-location: ${{ runner.temp }}/customDbLocation
|
||||
# Swift is not supported on Ubuntu so we manually exclude it from the list here
|
||||
languages: cpp,csharp,go,java,javascript,python,ruby
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: '>=1.21.0'
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: env -i PATH="$PATH" HOME="$HOME" ./build.sh
|
||||
- uses: ./../action/analyze
|
||||
id: analysis
|
||||
with:
|
||||
upload-database: false
|
||||
- shell: bash
|
||||
run: |
|
||||
CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
|
||||
if [[ ! -d "$CPP_DB" ]] || [[ ! "$CPP_DB" == "${RUNNER_TEMP}/customDbLocation/cpp" ]]; then
|
||||
echo "::error::Did not create a database for CPP, or created it in the wrong location." \
|
||||
"Expected location was '${RUNNER_TEMP}/customDbLocation/cpp' but actual was '${CPP_DB}'"
|
||||
exit 1
|
||||
fi
|
||||
CSHARP_DB="${{ fromJson(steps.analysis.outputs.db-locations).csharp }}"
|
||||
if [[ ! -d "$CSHARP_DB" ]] || [[ ! "$CSHARP_DB" == "${RUNNER_TEMP}/customDbLocation/csharp" ]]; then
|
||||
echo "::error::Did not create a database for C Sharp, or created it in the wrong location." \
|
||||
"Expected location was '${RUNNER_TEMP}/customDbLocation/csharp' but actual was '${CSHARP_DB}'"
|
||||
exit 1
|
||||
fi
|
||||
GO_DB="${{ fromJson(steps.analysis.outputs.db-locations).go }}"
|
||||
if [[ ! -d "$GO_DB" ]] || [[ ! "$GO_DB" == "${RUNNER_TEMP}/customDbLocation/go" ]]; then
|
||||
echo "::error::Did not create a database for Go, or created it in the wrong location." \
|
||||
"Expected location was '${RUNNER_TEMP}/customDbLocation/go' but actual was '${GO_DB}'"
|
||||
exit 1
|
||||
fi
|
||||
JAVA_DB="${{ fromJson(steps.analysis.outputs.db-locations).java }}"
|
||||
if [[ ! -d "$JAVA_DB" ]] || [[ ! "$JAVA_DB" == "${RUNNER_TEMP}/customDbLocation/java" ]]; then
|
||||
echo "::error::Did not create a database for Java, or created it in the wrong location." \
|
||||
"Expected location was '${RUNNER_TEMP}/customDbLocation/java' but actual was '${JAVA_DB}'"
|
||||
exit 1
|
||||
fi
|
||||
JAVASCRIPT_DB="${{ fromJson(steps.analysis.outputs.db-locations).javascript }}"
|
||||
if [[ ! -d "$JAVASCRIPT_DB" ]] || [[ ! "$JAVASCRIPT_DB" == "${RUNNER_TEMP}/customDbLocation/javascript" ]]; then
|
||||
echo "::error::Did not create a database for Javascript, or created it in the wrong location." \
|
||||
"Expected location was '${RUNNER_TEMP}/customDbLocation/javascript' but actual was '${JAVASCRIPT_DB}'"
|
||||
exit 1
|
||||
fi
|
||||
PYTHON_DB="${{ fromJson(steps.analysis.outputs.db-locations).python }}"
|
||||
if [[ ! -d "$PYTHON_DB" ]] || [[ ! "$PYTHON_DB" == "${RUNNER_TEMP}/customDbLocation/python" ]]; then
|
||||
echo "::error::Did not create a database for Python, or created it in the wrong location." \
|
||||
"Expected location was '${RUNNER_TEMP}/customDbLocation/python' but actual was '${PYTHON_DB}'"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
name: "Upload-sarif: 'ref' and 'sha' from inputs"
|
||||
description: "Checks that specifying 'ref' and 'sha' as inputs works"
|
||||
versions: ["default"]
|
||||
steps:
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
languages: cpp,csharp,java,javascript,python
|
||||
config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
|
||||
- name: Build code
|
||||
shell: bash
|
||||
run: ./build.sh
|
||||
# Generate some SARIF we can upload with the upload-sarif step
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
ref: 'refs/heads/main'
|
||||
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
|
||||
upload: never
|
||||
- uses: ./../action/upload-sarif
|
||||
with:
|
||||
ref: 'refs/heads/main'
|
||||
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
name: "Use a custom `checkout_path`"
|
||||
description: "Checks that a custom `checkout_path` will find the proper commit_oid"
|
||||
versions: ["linked"]
|
||||
steps:
|
||||
# This ensures we don't accidentally use the original checkout for any part of the test.
|
||||
- name: Delete original checkout
|
||||
shell: bash
|
||||
run: |
|
||||
# delete the original checkout so we don't accidentally use it.
|
||||
# Actions does not support deleting the current working directory, so we
|
||||
# delete the contents of the directory instead.
|
||||
rm -rf ./* .github .git
|
||||
# Check out the actions repo again, but at a different location.
|
||||
# choose an arbitrary SHA so that we can later test that the commit_oid is not from main
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
|
||||
path: x/y/z/some-path
|
||||
|
||||
- uses: ./../action/init
|
||||
with:
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
# it's enough to test one compiled language and one interpreted language
|
||||
languages: csharp,javascript
|
||||
source-root: x/y/z/some-path/tests/multi-language-repo
|
||||
|
||||
- name: Build code
|
||||
shell: bash
|
||||
working-directory: x/y/z/some-path/tests/multi-language-repo
|
||||
run: |
|
||||
./build.sh
|
||||
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
checkout_path: x/y/z/some-path/tests/multi-language-repo
|
||||
ref: v1.1.0
|
||||
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
|
||||
|
||||
- name: Verify SARIF after upload
|
||||
shell: bash
|
||||
run: |
|
||||
EXPECTED_COMMIT_OID="474bbf07f9247ffe1856c6a0f94aeeb10e7afee6"
|
||||
EXPECTED_REF="v1.1.0"
|
||||
EXPECTED_CHECKOUT_URI_SUFFIX="/x/y/z/some-path/tests/multi-language-repo"
|
||||
|
||||
ACTUAL_COMMIT_OID="$(cat "$RUNNER_TEMP/payload.json" | jq -r .commit_oid)"
|
||||
ACTUAL_REF="$(cat "$RUNNER_TEMP/payload.json" | jq -r .ref)"
|
||||
ACTUAL_CHECKOUT_URI="$(cat "$RUNNER_TEMP/payload.json" | jq -r .checkout_uri)"
|
||||
|
||||
if [[ "$EXPECTED_COMMIT_OID" != "$ACTUAL_COMMIT_OID" ]]; then
|
||||
echo "::error Invalid commit oid. Expected: $EXPECTED_COMMIT_OID Actual: $ACTUAL_COMMIT_OID"
|
||||
echo "$RUNNER_TEMP/payload.json"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ "$EXPECTED_REF" != "$ACTUAL_REF" ]]; then
|
||||
echo "::error Invalid ref. Expected: '$EXPECTED_REF' Actual: '$ACTUAL_REF'"
|
||||
echo "$RUNNER_TEMP/payload.json"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ "$ACTUAL_CHECKOUT_URI" != *$EXPECTED_CHECKOUT_URI_SUFFIX ]]; then
|
||||
echo "::error Invalid checkout URI suffix. Expected suffix: $EXPECTED_CHECKOUT_URI_SUFFIX Actual uri: $ACTUAL_CHECKOUT_URI"
|
||||
echo "$RUNNER_TEMP/payload.json"
|
||||
exit 1
|
||||
fi
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
name: "Zstandard bundle (streaming)"
|
||||
description: "Stream the download and extraction of a Zstandard-compressed CodeQL Bundle"
|
||||
versions:
|
||||
- linked
|
||||
operatingSystems:
|
||||
- macos
|
||||
- ubuntu
|
||||
env:
|
||||
CODEQL_ACTION_ZSTD_BUNDLE: true
|
||||
CODEQL_ACTION_ZSTD_BUNDLE_STREAMING_EXTRACTION: true
|
||||
steps:
|
||||
- name: Remove CodeQL from toolcache
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
|
||||
if (codeqlPath !== undefined) {
|
||||
fs.rmdirSync(codeqlPath, { recursive: true });
|
||||
}
|
||||
- id: init
|
||||
uses: ./../action/init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: ${{ runner.temp }}/results
|
||||
upload-database: false
|
||||
- name: Upload SARIF
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ${{ matrix.os }}-zstd-bundle.sarif
|
||||
path: ${{ runner.temp }}/results/javascript.sarif
|
||||
retention-days: 7
|
||||
- name: Check diagnostic with expected tools URL appears in SARIF
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
|
||||
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
|
||||
const run = sarif.runs[0];
|
||||
|
||||
const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
|
||||
const downloadTelemetryNotifications = toolExecutionNotifications.filter(n =>
|
||||
n.descriptor.id === 'codeql-action/bundle-download-telemetry'
|
||||
);
|
||||
if (downloadTelemetryNotifications.length !== 1) {
|
||||
core.setFailed(
|
||||
'Expected exactly one reporting descriptor in the ' +
|
||||
`'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
|
||||
`${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` +
|
||||
`${JSON.stringify(toolExecutionNotifications)}.`
|
||||
);
|
||||
}
|
||||
|
||||
const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl;
|
||||
console.log(`Found tools URL: ${toolsUrl}`);
|
||||
|
||||
if (!toolsUrl.endsWith('.tar.zst')) {
|
||||
core.setFailed(
|
||||
`Expected the tools URL to be a .tar.zst file, but found ${toolsUrl}.`
|
||||
);
|
||||
}
|
||||
70
github/codeql-action-v2/pr-checks/checks/zstd-bundle.yml
Normal file
70
github/codeql-action-v2/pr-checks/checks/zstd-bundle.yml
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
name: "Zstandard bundle"
|
||||
description: "Tests the feature flag that downloads a Zstandard-compressed CodeQL Bundle by default"
|
||||
versions:
|
||||
- linked
|
||||
operatingSystems:
|
||||
- macos
|
||||
- ubuntu
|
||||
- windows
|
||||
env:
|
||||
CODEQL_ACTION_ZSTD_BUNDLE: true
|
||||
steps:
|
||||
- name: Remove CodeQL from toolcache
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL');
|
||||
if (codeqlPath !== undefined) {
|
||||
fs.rmdirSync(codeqlPath, { recursive: true });
|
||||
}
|
||||
- id: init
|
||||
uses: ./../action/init
|
||||
with:
|
||||
languages: javascript
|
||||
tools: ${{ steps.prepare-test.outputs.tools-url }}
|
||||
- uses: ./../action/analyze
|
||||
with:
|
||||
output: ${{ runner.temp }}/results
|
||||
upload-database: false
|
||||
- name: Upload SARIF
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ${{ matrix.os }}-zstd-bundle.sarif
|
||||
path: ${{ runner.temp }}/results/javascript.sarif
|
||||
retention-days: 7
|
||||
- name: Check diagnostic with expected tools URL appears in SARIF
|
||||
uses: actions/github-script@v7
|
||||
env:
|
||||
SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
|
||||
with:
|
||||
script: |
|
||||
const fs = require('fs');
|
||||
|
||||
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
|
||||
const run = sarif.runs[0];
|
||||
|
||||
const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
|
||||
const downloadTelemetryNotifications = toolExecutionNotifications.filter(n =>
|
||||
n.descriptor.id === 'codeql-action/bundle-download-telemetry'
|
||||
);
|
||||
if (downloadTelemetryNotifications.length !== 1) {
|
||||
core.setFailed(
|
||||
'Expected exactly one reporting descriptor in the ' +
|
||||
`'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` +
|
||||
`${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` +
|
||||
`${JSON.stringify(toolExecutionNotifications)}.`
|
||||
);
|
||||
}
|
||||
|
||||
const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl;
|
||||
console.log(`Found tools URL: ${toolsUrl}`);
|
||||
|
||||
const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst';
|
||||
|
||||
if (!toolsUrl.endsWith(expectedExtension)) {
|
||||
core.setFailed(
|
||||
`Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.`
|
||||
);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue