Skip to content

Commit 937701c

Browse files
committed
Minor updates to README
1 parent 65a775c commit 937701c

File tree

1 file changed

+13
-20
lines changed

1 file changed

+13
-20
lines changed

README.md

Lines changed: 13 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22

33
## Overview
44

5-
This tool processes SARIF (Static Analysis Results Interchange Format) files, typically generated by static code analysis tools like CodeQL.
6-
The tool adds Secure Code Warrior contextual application security training material to SARIF files.
5+
This tool processes SARIF (Static Analysis Results Interchange Format) files, typically generated by static code analysis tools like CodeQL, and can be run as a GitHub Action or as a standalone CLI tool.
6+
It adds Secure Code Warrior contextual application security training material to SARIF files.
77
This training material will be displayed within Code Scanning alerts if the resulting SARIF file is imported using the `github/codeql-action/upload-sarif` Action, and includes links to secure coding exercises and short explainer videos where available.
88
This tool currently supports adding training material based on CWE references (e.g. CWE 89) and common vulnerability phrases (e.g. use-after-free vulnerability) included in static analysis findings.
99

@@ -18,25 +18,22 @@ This tool currently supports adding training material based on CWE references (e
1818
- Secure coding exercises
1919
- Short explainer videos (where available)
2020

21-
Currently, the tool supports adding training materials based on:
21+
Currently, the tool supports adding training materials based on:
2222

2323
- CWE references (e.g., CWE-89)
2424
- Common vulnerability phrases (e.g., use-after-free vulnerability)
2525

2626
These are extracted from static analysis findings to provide relevant, actionable learning resources alongside detected vulnerabilities.
2727

28-
- **Finding Name Normalization:**
29-
If a finding’s tool driver name is exactly `"CodeQL"` (case-sensitive), the tool updates it to `"GitHub CodeQL"`. This addresses known issues related to CodeQL tool naming, particularly when integrated with GitHub workflows.
30-
31-
- **Flexible File Input:**
28+
- **Flexible File Input:**
3229
Supports glob and wildcard patterns for input files, allowing batch processing of SARIF files in a directory, recursively, or by matching specific patterns.
3330

34-
- **Robust Output Handling:**
31+
- **Robust Output Handling:**
3532
Outputs processed SARIF results to specified filenames, with support for file overwriting and verification of output file patterns.
3633

3734
---
3835

39-
## Usage - Github Actions
36+
## Usage - GitHub Actions
4037

4138
### Individual SARIF file
4239

@@ -66,7 +63,6 @@ This tool currently supports adding training material based on CWE references (e
6663
with:
6764
inputSarifFile: sarif/findings.sarif
6865
outputSarifFile: sarif/findings.processed.sarif
69-
githubToken: ${{ secrets.GITHUB_TOKEN }}
7066

7167
- name: Import Results
7268
uses: github/codeql-action/upload-sarif@v3
@@ -92,7 +88,6 @@ This tool currently supports adding training material based on CWE references (e
9288
with:
9389
inputSarifFile: ./sarifs/*.json
9490
outputSarifFile: ./processed-sarifs
95-
githubToken: ${{ secrets.GITHUB_TOKEN }}
9691

9792
- name: Import Results
9893
uses: github/codeql-action/upload-sarif@v3
@@ -118,7 +113,6 @@ This tool currently supports adding training material based on CWE references (e
118113
with:
119114
inputSarifFile: ./sarifs
120115
outputSarifFile: ./processed-sarifs
121-
githubToken: ${{ secrets.GITHUB_TOKEN }}
122116

123117
- name: Import Results
124118
uses: github/codeql-action/upload-sarif@v3
@@ -143,17 +137,16 @@ This GitHub Action can also be run in CLI mode, to enable integration with other
143137
### Syntax
144138
```bash
145139
node clilauncher.js <input-pattern> <output-file>
146-
<input-pattern>: Path to the SARIF file(s) you want to process. Supports:
147-
148-
Exact file path
149-
Wildcard patterns (e.g., *.sarif)
150-
Recursive globstars (e.g., **/*.sarif)
151-
<output-file>: File path where the processed SARIF results will be saved.
152140
```
141+
- input-pattern: Path to the SARIF file(s) you want to process. Supports:
142+
- Exact file path
143+
- Wildcard patterns (e.g., *.sarif)
144+
- Recursive globstars (e.g., **/*.sarif)
145+
- output-file: File path where the processed SARIF results will be saved.
153146

154-
- **Important:**
147+
**Important:**
155148
- Globstar and wildcard patterns should be enclosed in quotes to prevent the shell from expanding them prematurely.
156-
- If a globstar pattern is used, the default output dir will be `./processed-sarifs`. Otherwise, files will be output to the root directory.
149+
- If a globstar pattern is used, the default output dir will be `./processed-sarifs`. Otherwise, files will be output to the root directory.
157150

158151
### Examples
159152

0 commit comments

Comments
 (0)