Skip to content

Commit ffbddb1

Browse files
GeekMasherGeekMasher
authored
Merge pull request #45 from GitHubSecurityLab/geekmasher-configs
CodeQL Configurations
2 parents 3fb0662 + 1442765 commit ffbddb1

File tree

6 files changed

+135
-0
lines changed

6 files changed

+135
-0
lines changed

‎.github/scripts/pr-configs.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
PR_NUMBER=${1}
5+
6+
codeql_code="/tmp/codeql-test-code"
7+
codeql_db="/tmp/codeql-test-database"
8+
9+
for file in $(gh pr view $PR_NUMBER --json files --jq '.files.[].path'); do
10+
if [[ ! -f "$file" ]]; then
11+
continue
12+
fi
13+
14+
# config file
15+
if [[ "$file" == configs/*.yml ]]; then
16+
echo "[+] Compiling Config :: $file"
17+
18+
if [[ -d "$codeql_db" ]]; then
19+
rm -rf "$codeql_db"
20+
fi
21+
22+
mkdir -p "$codeql_code"
23+
echo "print('Hello, World!')" > "$codeql_code/main.py"
24+
25+
codeql database create \
26+
--source-root=$codeql_code \
27+
--language=python \
28+
--codescanning-config=$file \
29+
"$codeql_db"
30+
fi
31+
done

‎.github/workflows/build.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,3 +141,34 @@ jobs:
141141
codeql pack install "${{ matrix.language }}/ext-library-sources/"
142142
codeql pack create "${{ matrix.language }}/ext-library-sources/"
143143
144+
configs:
145+
runs-on: ubuntu-latest
146+
needs: compile
147+
148+
steps:
149+
- uses: actions/checkout@v3
150+
151+
- uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50
152+
id: changes
153+
with:
154+
filters: |
155+
src:
156+
- 'configs/**'
157+
158+
- name: Initialize CodeQL
159+
if: steps.changes.outputs.src == 'true'
160+
run: |
161+
VERSION="$(find "${{ runner.tool_cache }}/CodeQL/" -maxdepth 1 -mindepth 1 -type d -print \
162+
| sort \
163+
| tail -n 1 \
164+
| tr -d '\n')"
165+
echo "$VERSION/x64/codeql" >> $GITHUB_PATH
166+
167+
- name: "Check Configurations"
168+
if: steps.changes.outputs.src == 'true'
169+
env:
170+
GITHUB_TOKEN: ${{ github.token }}
171+
run: |
172+
./.github/scripts/pr-configs.sh "${{ github.event.number }}"
173+
174+

‎README.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,18 @@ Using a `githubsecuritylab/codeql-LANG-queries` query pack will reference the de
3333
packs: githubsecuritylab/codeql-${{ matrix.language }}-queries
3434
```
3535
36+
### Using community packs with provided configuration file
37+
38+
This repository has a number of [provided configuration files][configurations] you can use or copy from the community packs.
39+
40+
```yaml
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v2
43+
with:
44+
languages: ${{ matrix.language }}
45+
config-file: GitHubSecurityLab/CodeQL-Community-Packs/configs/default.yml@main
46+
```
47+
3648
### Using a community pack from the CLI configuration file
3749
3850
```bash
@@ -54,3 +66,7 @@ This project is licensed under the terms of the MIT open source license. Please
5466
## Support
5567

5668
Please [create GitHub issues](https://github.com/advanced-security/brew-dependency-submission-action) for any feature requests, bugs, or documentation problems.
69+
70+
<!-- Resources / Links -->
71+
72+
[configurations]: ./configs

‎configs/README.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Community Configurations
2+
3+
## Default / CodeQL
4+
5+
The `default.yml` configuration is the default config file used to make it easy to use the CodeQL Community Packs.
6+
7+
## Audit
8+
9+
The `audit.yml` configuration is used primary to audit code by running a number of audit queries with CodeQL.
10+
These are based on the suite in each language suites folder called `{LANG}-audit.qls`
11+
12+
> [!NOTE]
13+
> Current Ruby and Swift are not supported

‎configs/audit.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "GitHub Community Pack Audit Configuration"
2+
3+
packs:
4+
# C/C++
5+
- githubsecuritylab/codeql-cpp-queries:suites/cpp-audit.qls
6+
# C#
7+
- githubsecuritylab/codeql-csharp-queries:suites/csharp-audit.qls
8+
- githubsecuritylab/codeql-csharp-extensions
9+
- githubsecuritylab/codeql-csharp-library-sources
10+
# Go
11+
- githubsecuritylab/codeql-go-queries:suites/go-audit.qls
12+
# Java
13+
- githubsecuritylab/codeql-java-queries:suites/java-audit.qls
14+
- githubsecuritylab/codeql-java-extensions
15+
- githubsecuritylab/codeql-java-library-sources
16+
# JavaScript / Typescript
17+
- githubsecuritylab/codeql-javascript-queries:suites/javascript-audit.qls
18+
# Python
19+
- githubsecuritylab/codeql-python-queries:suites/python-audit.qls
20+
# Ruby
21+
# - githubsecuritylab/codeql-ruby-queries:suites/ruby-audit.qls
22+

‎configs/default.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "GitHub Community Pack Default CodeQL Configuration"
2+
3+
packs:
4+
# C/C++
5+
- githubsecuritylab/codeql-cpp-queries
6+
# C#
7+
- githubsecuritylab/codeql-csharp-queries
8+
- githubsecuritylab/codeql-csharp-extensions
9+
- githubsecuritylab/codeql-csharp-library-sources
10+
# Go
11+
- githubsecuritylab/codeql-go-queries
12+
# Java
13+
- githubsecuritylab/codeql-java-queries
14+
- githubsecuritylab/codeql-java-extensions
15+
- githubsecuritylab/codeql-java-library-sources
16+
# JavaScript / Typescript
17+
- githubsecuritylab/codeql-javascript-queries
18+
# Python
19+
- githubsecuritylab/codeql-python-queries
20+
# Ruby
21+
- githubsecuritylab/codeql-ruby-queries
22+

0 commit comments

Comments
 (0)