Skip to content

Commit 9be8fbc

Browse files
aegilopsaegilops
authored
Merge branch 'main' into dependabot/github_actions/actions/labeler-6
2 parents 1447906 + 648644f commit 9be8fbc

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+1323
-1047
lines changed

‎.all-contributorsrc‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,15 @@
5656
"design",
5757
"ideas"
5858
]
59+
},
60+
{
61+
"login": "ViktorLindstrm",
62+
"name": "Viktor Lindström",
63+
"avatar_url": "https://avatars.githubusercontent.com/u/3715582?v=4",
64+
"profile": "https://github.com/ViktorLindstrm",
65+
"contributions": [
66+
"code"
67+
]
5968
}
6069
]
61-
}
70+
}

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
# This project is maintained with love by:
1+
# This project is maintained with love by
22

3-
- @geekmasher
3+
- @advanced-security/oss-maintainers

‎.github/action/src/codeql.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import * as github from "@actions/github";
77
import * as toolrunner from "@actions/exec/lib/toolrunner";
88

99
export const EXTRACTOR_REPOSITORY = "advanced-security/codeql-extractor-iac";
10-
export const EXTRACTOR_VERSION = "v0.4.1"; // stable version
10+
export const EXTRACTOR_VERSION = "v0.5.0"; // stable version
1111

1212
export interface CodeQLConfig {
1313
// The path to the codeql bundle.

‎.github/dependabot.yml‎

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,38 @@
55

66
version: 2
77
updates:
8-
- package-ecosystem: "cargo"
8+
- package-ecosystem: "github-actions"
99
directory: "/"
1010
schedule:
1111
interval: "weekly"
1212
reviewers:
13-
- "geekmasher"
13+
- "advanced-security/oss-maintainers"
14+
target-branch: "main"
15+
commit-message:
16+
prefix: deps
17+
prefix-development: chore
18+
labels:
19+
- "Dependencies"
1420
groups:
15-
extractor:
21+
production-dependencies:
1622
dependency-type: "production"
23+
development-dependencies:
24+
dependency-type: "development"
1725

18-
- package-ecosystem: "github-actions"
26+
- package-ecosystem: "cargo"
1927
directory: "/"
2028
schedule:
2129
interval: "weekly"
2230
reviewers:
23-
- "geekmasher"
31+
- "advanced-security/oss-maintainers"
32+
target-branch: "main"
33+
commit-message:
34+
prefix: deps
35+
prefix-development: chore
36+
labels:
37+
- "Dependencies"
38+
groups:
39+
production-dependencies:
40+
dependency-type: "production"
41+
development-dependencies:
42+
dependency-type: "development"

‎.github/workflows/build.yml‎

Lines changed: 77 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ jobs:
4747
4848
tar -zxf extractor-iac.tar.gz
4949
50+
chmod +x extractor-pack/tools/*.sh
51+
chmod +x extractor-pack/tools/**/*
52+
5053
- uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
5154
if: steps.extractor-changes.outputs.src == 'true'
5255

@@ -69,79 +72,80 @@ jobs:
6972
run: |
7073
./scripts/run-tests.sh "ql/test/${{ matrix.test-folders }}"
7174
72-
scanning:
73-
runs-on: ubuntu-latest
74-
needs: [tests]
75-
76-
strategy:
77-
matrix:
78-
project: ["hashicorp/terraform-guides", "akamai/terraform-examples", "aws-samples/aws-sam-terraform-examples"]
79-
80-
steps:
81-
- name: "Checkout"
82-
uses: actions/checkout@v5
83-
with:
84-
submodules: true
85-
86-
- name: "Checkout"
87-
uses: actions/checkout@v5
88-
with:
89-
repository: ${{ matrix.project }}
90-
path: project
91-
92-
- name: "Check for changes"
93-
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
94-
id: extractor-changes
95-
with:
96-
filters: |
97-
src:
98-
- 'extractor/**'
99-
- 'rust-toolchain.toml'
100-
- 'Cargo.*'
101-
102-
- name: "Download Extracter"
103-
if: steps.extractor-changes.outputs.src == 'false'
104-
env:
105-
GH_TOKEN: ${{ github.token }}
106-
run: |
107-
set -e
108-
gh release list -L 1 -R "advanced-security/codeql-extractor-iac"
109-
110-
gh release download \
111-
-R "advanced-security/codeql-extractor-iac" \
112-
--clobber \
113-
--pattern 'extractor-iac.tar.gz'
114-
115-
tar -zxf extractor-iac.tar.gz
116-
117-
- uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
118-
if: steps.extractor-changes.outputs.src == 'true'
119-
120-
- name: "Build Extractor"
121-
if: steps.extractor-changes.outputs.src == 'true'
122-
env:
123-
GH_TOKEN: ${{ github.token }}
124-
run: |
125-
set -e
126-
gh extensions install github/gh-codeql
127-
gh codeql set-version latest
128-
129-
./scripts/create-extractor-pack.sh
130-
131-
gh codeql resolve languages --format=json --search-path ./extractor-pack
132-
133-
- name: "Run CodeQL Analysis"
134-
env:
135-
GH_TOKEN: ${{ github.token }}
136-
PROJECT_REPO: ${{ matrix.project }}
137-
run: |
138-
set -e
139-
gh extensions install github/gh-codeql
140-
gh codeql set-version latest
141-
142-
gh codeql database create iac-db --language=iac --source-root=./project --search-path ./extractor-pack
143-
144-
gh codeql database analyze iac-db "advanced-security/iac-queries" --format=sarifv2.1.0 --output="iac-${PROJECT_REPO}.sarif"
75+
# scanning:
76+
# runs-on: ubuntu-latest
77+
# needs: [tests]
78+
79+
# strategy:
80+
# matrix:
81+
# # project: ["hashicorp/terraform-guides", "akamai/terraform-examples", "aws-samples/aws-sam-terraform-examples"]
82+
# project: []
83+
84+
# steps:
85+
# - name: "Checkout"
86+
# uses: actions/checkout@v5
87+
# with:
88+
# submodules: true
89+
90+
# - name: "Checkout"
91+
# uses: actions/checkout@v5
92+
# with:
93+
# repository: ${{ matrix.project }}
94+
# path: project
95+
96+
# - name: "Check for changes"
97+
# uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
98+
# id: extractor-changes
99+
# with:
100+
# filters: |
101+
# src:
102+
# - 'extractor/**'
103+
# - 'rust-toolchain.toml'
104+
# - 'Cargo.*'
105+
106+
# - name: "Download Extracter"
107+
# if: steps.extractor-changes.outputs.src == 'false'
108+
# env:
109+
# GH_TOKEN: ${{ github.token }}
110+
# run: |
111+
# set -e
112+
# gh release list -L 1 -R "advanced-security/codeql-extractor-iac"
113+
114+
# gh release download \
115+
# -R "advanced-security/codeql-extractor-iac" \
116+
# --clobber \
117+
# --pattern 'extractor-iac.tar.gz'
118+
119+
# tar -zxf extractor-iac.tar.gz
120+
121+
# - uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
122+
# if: steps.extractor-changes.outputs.src == 'true'
123+
124+
# - name: "Build Extractor"
125+
# if: steps.extractor-changes.outputs.src == 'true'
126+
# env:
127+
# GH_TOKEN: ${{ github.token }}
128+
# run: |
129+
# set -e
130+
# gh extensions install github/gh-codeql
131+
# gh codeql set-version latest
132+
133+
# ./scripts/create-extractor-pack.sh
134+
135+
# gh codeql resolve languages --format=json --search-path ./extractor-pack
136+
137+
# - name: "Run CodeQL Analysis"
138+
# env:
139+
# GH_TOKEN: ${{ github.token }}
140+
# PROJECT_REPO: ${{ matrix.project }}
141+
# run: |
142+
# set -e
143+
# gh extensions install github/gh-codeql
144+
# gh codeql set-version latest
145+
146+
# gh codeql database create --language=iac --source-root=./project --search-path ./extractor-pack iac-db
147+
148+
# gh codeql database analyze --search-path ./extractor-pack --format sarif-latest --output="iac-${PROJECT_REPO}.sarif" iac-db ./ql/src
145149

146150

147151
docs:

‎.github/workflows/copilot-setup-steps.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
name: "Copilot Setup Steps"
3+
4+
# Automatically run the setup steps when they are changed to allow for
5+
# easy validation, and manual testing through the repository's Actions tab
6+
on:
7+
workflow_dispatch: {}
8+
push:
9+
paths:
10+
- .github/workflows/copilot-setup-steps.yml
11+
pull_request:
12+
paths:
13+
- .github/workflows/copilot-setup-steps.yml
14+
15+
jobs:
16+
# The job MUST be called `copilot-setup-steps` or it will not be picked up
17+
# by Copilot.
18+
copilot-setup-steps:
19+
runs-on: ubuntu-latest
20+
21+
# Set the permissions to the lowest permissions possible needed for your
22+
# steps. Copilot will be given its own token for its operations.
23+
permissions:
24+
# If you want to clone the repository as part of your setup steps, for
25+
# example to install dependencies, you'll need the `contents: read`
26+
# permission. If you don't clone the repository in your setup steps,
27+
# Copilot will do this for you automatically after the steps complete.
28+
contents: read
29+
30+
# You can define any steps you want, and they will run before the agent
31+
# starts. If you do not check out your code, Copilot will do this for you.
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v5
35+
with:
36+
submodules: true
37+
38+
- name: Install GitHub CLI CodeQL extension
39+
env:
40+
GH_TOKEN: ${{ github.token }}
41+
run: |
42+
# Install GitHub CLI (should already be available in ubuntu-latest)
43+
gh --version
44+
45+
# Install CodeQL CLI extension
46+
gh extension install github/gh-codeql
47+
48+
# Set CodeQL to latest version
49+
gh codeql set-version latest
50+
51+
# Verify the extension is installed and working
52+
gh codeql version
53+
54+
# Install packs
55+
(cd ./ql/src/ && gh codeql pack install)
56+
(cd ./ql/lib/ && gh codeql pack install)
57+
(cd ./ql/test/ && gh codeql pack install)

‎.github/workflows/coverage.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
./scripts/create-coverage.py report --markdown > $GITHUB_STEP_SUMMARY
2323
2424
- name: "Upload Coverage Report"
25-
uses: actions/upload-artifact@v4
25+
uses: actions/upload-artifact@v5
2626
with:
2727
name: coverage-report
2828
path: coverage.csv

0 commit comments

Comments
 (0)