Skip to content

aliscco/codeql-action

This branch is 1 commit ahead of, 5116 commits behind github/codeql-action:main.

Folders and files

NameName
Last commit message
Last commit date
Jun 16, 2021
May 13, 2021
Jun 21, 2021
Aug 24, 2020
May 17, 2021
Jun 21, 2021
Nov 29, 2023
Mar 8, 2021
Jun 2, 2021
Jun 17, 2021
Jun 21, 2021
Jun 16, 2021
Apr 28, 2021
Jun 23, 2020
Sep 14, 2020
Jan 15, 2021
May 20, 2021
Aug 25, 2020
Jun 17, 2021
Jun 17, 2021
Apr 28, 2020
Jun 2, 2021
Apr 28, 2020
May 28, 2021
Jun 17, 2021
Jun 17, 2021
Aug 10, 2020

Repository files navigation

CodeQL Action

This action runs GitHub's industry-leading semantic code analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of queries, which have been developed by the community and the GitHub Security Lab to find common vulnerabilities in your code.

For a list of recent changes, see the CodeQL Action's changelog.

License

This project is released under the MIT License.

The underlying CodeQL CLI, used in this action, is licensed under the GitHub CodeQL Terms and Conditions. As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.

Usage

This is a short walkthrough, but for more information read configuring code scanning.

To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:

name: "Code Scanning - Action"

on:
  push:
  pull_request:
  schedule:
    #        ┌───────────── minute (0 - 59)
    #        │  ┌───────────── hour (0 - 23)
    #        │  │ ┌───────────── day of the month (1 - 31)
    #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
    #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
    #        │  │ │ │ │
    #        │  │ │ │ │
    #        │  │ │ │ │
    #        *  * * * *
    - cron: '30 1 * * 0'

jobs:
  CodeQL-Build:
    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v1
        # Override language selection by uncommenting this and choosing your languages
        # with:
        #   languages: go, javascript, csharp, python, cpp, java

      # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below).
      - name: Autobuild
        uses: github/codeql-action/autobuild@v1

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 https://git.io/JvXDl

      # ✏️ If the Autobuild fails above, remove it and uncomment the following
      #    three lines and modify them (or add more) to build your code if your
      #    project uses a compiled language

      #- run: |
      #   make bootstrap
      #   make release

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v1

If you prefer to integrate this within an existing CI workflow, it should end up looking something like this:

- name: Initialize CodeQL
  uses: github/codeql-action/init@v1
  with:
    languages: go, javascript

# Here is where you build your code
- run: |
  make bootstrap
  make release

- name: Perform CodeQL Analysis
  uses: github/codeql-action/analyze@v1

Configuration file

Use the config-file parameter of the init action to enable the configuration file. The value of config-file is the path to the configuration file you want to use. This example loads the configuration file ./.github/codeql/codeql-config.yml.

- uses: github/codeql-action/init@v1
  with:
    config-file: ./.github/codeql/codeql-config.yml

The configuration file can be located in a different repository. This is useful if you want to share the same configuration across multiple repositories. If the configuration file is in a private repository you can also specify an external-repository-token option. This should be a personal access token that has read access to any repositories containing referenced config files and queries.

- uses: github/codeql-action/init@v1
  with:
    config-file: owner/repo/codeql-config.yml@branch
    external-repository-token: ${{ secrets.EXTERNAL_REPOSITORY_TOKEN }}

For information on how to write a configuration file, see "Using a custom configuration file."

If you only want to customise the queries used, you can specify them in your workflow instead of creating a config file, using the queries property of the init action:

- uses: github/codeql-action/init@v1
  with:
    queries: <local-or-remote-query>,<another-query>

By default, this will override any queries specified in a config file. If you wish to use both sets of queries, prefix the list of queries in the workflow with +:

- uses: github/codeql-action/init@v1
  with:
    queries: +<local-or-remote-query>,<another-query>

Troubleshooting

Read about troubleshooting code scanning.

About

Actions for running CodeQL analysis

Resources

License

Code of conduct

Stars

Watchers

Forks

Packages

No packages published

Languages

  • TypeScript 87.7%
  • Python 5.5%
  • CodeQL 5.0%
  • Shell 1.2%
  • PowerShell 0.4%
  • JavaScript 0.1%
  • Other 0.1%