Skip to content

Commit 6a1e814

Browse files
boveusboveus
authored
Merge pull request #106 from github/advanced-config
Add rule to detect cases where CodeQL default setup could be used instead of advanced setup
2 parents ae6856a + 686e30a commit 6a1e814

File tree

8 files changed

+178
-0
lines changed

8 files changed

+178
-0
lines changed

‎ql/lib/codeql/actions/Violations Of Best Practices/DefaultableCodeQLInitiatlizeActionQuery.qll

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
private import actions
2+
3+
/**
4+
* Holds if workflow step uses the github/codeql-action/init action with no customizations.
5+
* e.g.
6+
* - name: Initialize
7+
* uses: github/codeql-action/init@v2
8+
* with:
9+
* languages: ruby, javascript
10+
*
11+
*/
12+
13+
class DefaultableCodeQLInitiatlizeActionQuery extends UsesStep {
14+
DefaultableCodeQLInitiatlizeActionQuery() {
15+
this.getCallee() = "github/codeql-action/init" and
16+
not customizedWorkflowStep(this)
17+
}
18+
}
19+
20+
/**
21+
* Holds if the with: part of the workflow step contains any arguments for with: other than "languages".
22+
* e.g.
23+
* - name: Initialize CodeQL
24+
* uses: github/codeql-action/init@v3
25+
* with:
26+
* languages: ${{ matrix.language }}
27+
* config-file: ./.github/codeql/${{ matrix.language }}/codeql-config.yml
28+
*
29+
*/
30+
31+
predicate customizedWorkflowStep(UsesStep codeQLInitStep) {
32+
exists(string arg |
33+
exists(codeQLInitStep.getArgument(arg)) and
34+
arg != "languages"
35+
)
36+
}

‎ql/src/Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Unneccesary use of advanced configuration
2+
3+
## Description
4+
5+
The CodeQL workflow does not use any custom settings and could be simplified by switching to the CodeQL default setup.
6+
7+
## Recommendations
8+
9+
If there is no reason to have a custom configuration switch to the CodeQL default setup.
10+
11+
## References
12+
13+
- [GitHub Docs: Configuring Default Setup for a repository](https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning#configuring-default-setup-for-a-repository)

‎ql/src/Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
/**
2+
* @name Workflow Should Use Default Setup
3+
* @description Workflows should use CodeQL Action with default setup instead of advanced configuration if there are no customizations
4+
* @kind problem
5+
* @problem.severity recommendation
6+
* @precision high
7+
* @id actions/unnecessary-use-of-advanced-config
8+
* @tags actions
9+
* maintainability
10+
*/
11+
12+
import codeql.actions.Violations_Of_Best_Practices.DefaultableCodeQLInitiatlizeActionQuery
13+
14+
from DefaultableCodeQLInitiatlizeActionQuery action
15+
select action, "CodeQL Action could use default setup instead of advanced configuration."

‎ql/test/query-tests/Violations Of Best Practice/CodeQL/.github/workflows/defaultable_workflow.yml

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: 'CodeQL'
13+
14+
on:
15+
push:
16+
branches: [main]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: [main]
20+
schedule:
21+
- cron: '16 2 * * 5'
22+
23+
jobs:
24+
analyze:
25+
name: Analyze
26+
runs-on: ubuntu-latest
27+
permissions:
28+
actions: read
29+
contents: read
30+
security-events: write
31+
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
language: ['javascript']
36+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
37+
# Learn more about CodeQL language support at https://git.io/codeql-language-support
38+
39+
steps:
40+
- name: Checkout repository
41+
uses: actions/checkout@v4
42+
43+
# Initializes the CodeQL tools for scanning.
44+
- name: Initialize CodeQL
45+
uses: github/codeql-action/init@v3
46+
with:
47+
languages: ${{ matrix.language }}
48+
# If you wish to specify custom queries, you can do so here or in a config file.
49+
# By default, queries listed here will override any specified in a config file.
50+
# Prefix the list here with "+" to use these queries and those in the config file.
51+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
52+
53+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
54+
# If this step fails, then you should remove it and run the build manually (see below)
55+
- name: Autobuild
56+
uses: github/codeql-action/autobuild@v3
57+
58+
# ℹ️ Command-line programs to run using the OS shell.
59+
# 📚 https://git.io/JvXDl
60+
61+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
62+
# and modify them (or add more) to build your code if your project
63+
# uses a compiled language
64+
65+
#- run: |
66+
# make bootstrap
67+
# make release
68+
69+
- name: Perform CodeQL Analysis
70+
uses: github/codeql-action/analyze@v3

‎ql/test/query-tests/Violations Of Best Practice/CodeQL/.github/workflows/should_be_using_advanced_setup.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: 'CodeQL'
2+
3+
on:
4+
push:
5+
branches: ['master']
6+
pull_request:
7+
branches: ['master']
8+
9+
permissions:
10+
actions: read
11+
contents: read
12+
packages: read
13+
security-events: write
14+
15+
jobs:
16+
analyze:
17+
name: Analyze
18+
runs-on: ${{ matrix.os }}
19+
strategy:
20+
fail-fast: false
21+
matrix:
22+
include:
23+
- language: javascript
24+
os: ubuntu-22.04
25+
- language: ruby
26+
os: ubuntu-22.04-16core
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v4
31+
32+
- name: Initialize CodeQL
33+
uses: github/codeql-action/init@v3
34+
with:
35+
languages: ${{ matrix.language }}
36+
config-file: ./.github/codeql/${{ matrix.language }}/codeql-config.yml
37+
38+
- name: Perform CodeQL Analysis
39+
uses: github/codeql-action/analyze@v3
40+
with:
41+
category: codeql/${{ matrix.language }}/full

‎ql/test/query-tests/Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.actual

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| .github/workflows/defaultable_workflow.yml:44:9:55:6 | Uses Step | CodeQL Action could use default setup instead of advanced configuration. |

‎ql/test/query-tests/Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| .github/workflows/defaultable_workflow.yml:44:9:55:6 | Uses Step | CodeQL Action could use default setup instead of advanced configuration. |

‎ql/test/query-tests/Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql

0 commit comments

Comments
 (0)