You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+13-20Lines changed: 13 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,8 +2,8 @@
2
2
3
3
## Overview
4
4
5
-
This tool processes SARIF (Static Analysis Results Interchange Format) files, typically generated by static code analysis tools like CodeQL.
6
-
The tool adds Secure Code Warrior contextual application security training material to SARIF files.
5
+
This tool processes SARIF (Static Analysis Results Interchange Format) files, typically generated by static code analysis tools like CodeQL, and can be run as a GitHub Action or as a standalone CLI tool.
6
+
It adds Secure Code Warrior contextual application security training material to SARIF files.
7
7
This training material will be displayed within Code Scanning alerts if the resulting SARIF file is imported using the `github/codeql-action/upload-sarif` Action, and includes links to secure coding exercises and short explainer videos where available.
8
8
This tool currently supports adding training material based on CWE references (e.g. CWE 89) and common vulnerability phrases (e.g. use-after-free vulnerability) included in static analysis findings.
9
9
@@ -18,25 +18,22 @@ This tool currently supports adding training material based on CWE references (e
18
18
- Secure coding exercises
19
19
- Short explainer videos (where available)
20
20
21
-
Currently, the tool supports adding training materials based on:
21
+
Currently, the tool supports adding training materials based on:
22
22
23
23
- CWE references (e.g., CWE-89)
24
24
- Common vulnerability phrases (e.g., use-after-free vulnerability)
25
25
26
26
These are extracted from static analysis findings to provide relevant, actionable learning resources alongside detected vulnerabilities.
27
27
28
-
-**Finding Name Normalization:**
29
-
If a finding’s tool driver name is exactly `"CodeQL"` (case-sensitive), the tool updates it to `"GitHub CodeQL"`. This addresses known issues related to CodeQL tool naming, particularly when integrated with GitHub workflows.
30
-
31
-
-**Flexible File Input:**
28
+
-**Flexible File Input:**
32
29
Supports glob and wildcard patterns for input files, allowing batch processing of SARIF files in a directory, recursively, or by matching specific patterns.
33
30
34
-
-**Robust Output Handling:**
31
+
-**Robust Output Handling:**
35
32
Outputs processed SARIF results to specified filenames, with support for file overwriting and verification of output file patterns.
36
33
37
34
---
38
35
39
-
## Usage - Github Actions
36
+
## Usage - GitHub Actions
40
37
41
38
### Individual SARIF file
42
39
@@ -66,7 +63,6 @@ This tool currently supports adding training material based on CWE references (e
66
63
with:
67
64
inputSarifFile: sarif/findings.sarif
68
65
outputSarifFile: sarif/findings.processed.sarif
69
-
githubToken: ${{ secrets.GITHUB_TOKEN }}
70
66
71
67
- name: Import Results
72
68
uses: github/codeql-action/upload-sarif@v3
@@ -92,7 +88,6 @@ This tool currently supports adding training material based on CWE references (e
92
88
with:
93
89
inputSarifFile: ./sarifs/*.json
94
90
outputSarifFile: ./processed-sarifs
95
-
githubToken: ${{ secrets.GITHUB_TOKEN }}
96
91
97
92
- name: Import Results
98
93
uses: github/codeql-action/upload-sarif@v3
@@ -118,7 +113,6 @@ This tool currently supports adding training material based on CWE references (e
118
113
with:
119
114
inputSarifFile: ./sarifs
120
115
outputSarifFile: ./processed-sarifs
121
-
githubToken: ${{ secrets.GITHUB_TOKEN }}
122
116
123
117
- name: Import Results
124
118
uses: github/codeql-action/upload-sarif@v3
@@ -143,17 +137,16 @@ This GitHub Action can also be run in CLI mode, to enable integration with other
143
137
### Syntax
144
138
```bash
145
139
node clilauncher.js <input-pattern> <output-file>
146
-
<input-pattern>: Path to the SARIF file(s) you want to process. Supports:
147
-
148
-
Exact file path
149
-
Wildcard patterns (e.g., *.sarif)
150
-
Recursive globstars (e.g., **/*.sarif)
151
-
<output-file>: File path where the processed SARIF results will be saved.
152
140
```
141
+
- input-pattern: Path to the SARIF file(s) you want to process. Supports:
142
+
- Exact file path
143
+
- Wildcard patterns (e.g., *.sarif)
144
+
- Recursive globstars (e.g., **/*.sarif)
145
+
- output-file: File path where the processed SARIF results will be saved.
153
146
154
-
- **Important:**
147
+
**Important:**
155
148
- Globstar and wildcard patterns should be enclosed in quotes to prevent the shell from expanding them prematurely.
156
-
- If a globstar pattern is used, the default output dir will be `./processed-sarifs`. Otherwise, files will be output to the root directory.
149
+
- If a globstar pattern is used, the default output dir will be `./processed-sarifs`. Otherwise, files will be output to the root directory.
0 commit comments