Skip to content

Commit 65e1c0e

Browse files
hvitvedhvitved
committed
Merge remote-tracking branch 'upstream/main' into cs/hash-without-salt
2 parents 6a2c7d5 + 497c878 commit 65e1c0e

File tree

12,998 files changed

+1310654
-414690
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

12,998 files changed

+1310654
-414690
lines changed

‎.codeqlmanifest.json

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,27 @@
1-
{ "provide": [ "*/ql/src/qlpack.yml",
2-
"*/ql/test/qlpack.yml",
3-
"*/ql/examples/qlpack.yml",
4-
"*/upgrades/qlpack.yml",
5-
"misc/legacy-support/*/qlpack.yml",
6-
"misc/suite-helpers/qlpack.yml" ] }
1+
{
2+
"provide": [
3+
"*/ql/src/qlpack.yml",
4+
"*/ql/lib/qlpack.yml",
5+
"*/ql/test/qlpack.yml",
6+
"*/ql/examples/qlpack.yml",
7+
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
8+
"javascript/ql/experimental/adaptivethreatmodeling/lib/qlpack.yml",
9+
"javascript/ql/experimental/adaptivethreatmodeling/src/qlpack.yml",
10+
"csharp/ql/campaigns/Solorigate/lib/qlpack.yml",
11+
"csharp/ql/campaigns/Solorigate/src/qlpack.yml",
12+
"csharp/ql/campaigns/Solorigate/test/qlpack.yml",
13+
"misc/legacy-support/*/qlpack.yml",
14+
"misc/suite-helpers/qlpack.yml",
15+
"ruby/extractor-pack/codeql-extractor.yml",
16+
"ruby/ql/consistency-queries/qlpack.yml",
17+
"ql/ql/consistency-queries/qlpack.yml",
18+
"ql/extractor-pack/codeql-extractor.yml"
19+
],
20+
"versionPolicies": {
21+
"default": {
22+
"requireChangeNotes": true,
23+
"committedPrereleaseSuffix": "dev",
24+
"committedVersion": "nextPatchRelease"
25+
}
26+
}
27+
}

‎.devcontainer/devcontainer.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
{
22
"extensions": [
3+
"rust-lang.rust",
4+
"bungcip.better-toml",
35
"github.vscode-codeql",
46
"slevesque.vscode-zipexplorer"
57
],
68
"settings": {
9+
"files.watcherExclude": {
10+
"**/target/**": true
11+
},
712
"codeQL.runningQueries.memory": 2048
813
}
914
}

‎.gitattributes

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,6 @@
4848
*.gif -text
4949
*.dll -text
5050
*.pdb -text
51+
52+
java/ql/test/stubs/**/*.java linguist-generated=true
53+
java/ql/test/experimental/stubs/**/*.java linguist-generated=true

‎.github/actions/fetch-codeql/action.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Fetch CodeQL
2+
description: Fetches the latest version of CodeQL
3+
runs:
4+
using: composite
5+
steps:
6+
- name: Fetch CodeQL
7+
shell: bash
8+
run: |
9+
LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
10+
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-linux64.zip "$LATEST"
11+
unzip -q -d "${RUNNER_TEMP}" codeql-linux64.zip
12+
echo "${RUNNER_TEMP}/codeql" >> "${GITHUB_PATH}"
13+
env:
14+
GITHUB_TOKEN: ${{ github.token }}

‎.github/dependabot.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "cargo"
4+
directory: "ruby/node-types"
5+
schedule:
6+
interval: "daily"
7+
- package-ecosystem: "cargo"
8+
directory: "ruby/generator"
9+
schedule:
10+
interval: "daily"
11+
- package-ecosystem: "cargo"
12+
directory: "ruby/extractor"
13+
schedule:
14+
interval: "daily"
15+
- package-ecosystem: "cargo"
16+
directory: "ruby/autobuilder"
17+
schedule:
18+
interval: "daily"

‎.github/labeler.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,14 @@ Python:
1818
- python/**/*
1919
- change-notes/**/*python*
2020

21+
Ruby:
22+
- ruby/**/*
23+
- change-notes/**/*ruby*
24+
2125
documentation:
2226
- "**/*.qhelp"
2327
- "**/*.md"
2428
- docs/**/*
29+
30+
"QL-for-QL":
31+
- ql/**/*

‎.github/workflows/check-change-note.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Check change note
2+
3+
on:
4+
pull_request_target:
5+
types: [labeled, unlabeled, opened, synchronize, reopened, ready_for_review]
6+
paths:
7+
- "*/ql/src/**/*.ql"
8+
- "*/ql/src/**/*.qll"
9+
- "!**/experimental/**"
10+
- "!ql/**"
11+
12+
jobs:
13+
check-change-note:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Fail if no change note found. To fix, either add one, or add the `no-change-note-required` label.
17+
if: |
18+
github.event.pull_request.draft == false &&
19+
!contains(github.event.pull_request.labels.*.name, 'no-change-note-required')
20+
env:
21+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
22+
run: |
23+
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
24+
grep true -c

‎.github/workflows/close-stale.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Mark stale issues
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "30 1 * * *"
7+
8+
jobs:
9+
stale:
10+
if: github.repository == 'github/codeql'
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/stale@v3
16+
with:
17+
repo-token: ${{ secrets.GITHUB_TOKEN }}
18+
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
19+
close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
20+
days-before-stale: 14
21+
days-before-close: 7
22+
only-labels: awaiting-response
23+
24+
# do not mark PRs as stale
25+
days-before-pr-stale: -1
26+
days-before-pr-close: -1
27+
28+
# Uncomment for dry-run
29+
# debug-only: true
30+
# operations-per-run: 1000

‎.github/workflows/codeql-analysis.yml

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,17 @@ name: "Code scanning - action"
22

33
on:
44
push:
5+
branches:
6+
- main
7+
- 'rc/*'
58
pull_request:
9+
branches:
10+
- main
11+
- 'rc/*'
12+
paths:
13+
- 'csharp/**'
14+
- '.github/codeql/**'
15+
- '.github/workflows/codeql-analysis.yml'
616
schedule:
717
- cron: '0 9 * * 1'
818

@@ -11,31 +21,27 @@ jobs:
1121

1222
runs-on: ubuntu-latest
1323

24+
permissions:
25+
contents: read
26+
security-events: write
27+
pull-requests: read
28+
1429
steps:
1530
- name: Checkout repository
1631
uses: actions/checkout@v2
17-
with:
18-
# We must fetch at least the immediate parents so that if this is
19-
# a pull request then we can checkout the head.
20-
fetch-depth: 2
21-
22-
# If this run was triggered by a pull request event, then checkout
23-
# the head of the pull request instead of the merge commit.
24-
- run: git checkout HEAD^2
25-
if: ${{ github.event_name == 'pull_request' }}
26-
32+
2733
# Initializes the CodeQL tools for scanning.
2834
- name: Initialize CodeQL
29-
uses: github/codeql-action/init@v1
35+
uses: github/codeql-action/init@main
3036
# Override language selection by uncommenting this and choosing your languages
3137
with:
3238
languages: csharp
3339
config-file: ./.github/codeql/codeql-config.yml
3440

3541
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
3642
# If this step fails, then you should remove it and run the build manually (see below)
37-
- name: Autobuild
38-
uses: github/codeql-action/autobuild@v1
43+
#- name: Autobuild
44+
# uses: github/codeql-action/autobuild@main
3945

4046
# ℹ️ Command-line programs to run using the OS shell.
4147
# 📚 https://git.io/JvXDl
@@ -44,9 +50,8 @@ jobs:
4450
# and modify them (or add more) to build your code if your project
4551
# uses a compiled language
4652

47-
#- run: |
48-
# make bootstrap
49-
# make release
53+
- run: |
54+
dotnet build csharp
5055
5156
- name: Perform CodeQL Analysis
52-
uses: github/codeql-action/analyze@v1
57+
uses: github/codeql-action/analyze@main

‎.github/workflows/csv-coverage-pr-artifacts.yml

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Check framework coverage changes
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- '.github/workflows/csv-coverage-pr-comment.yml'
7+
- '*/ql/src/**/*.ql'
8+
- '*/ql/src/**/*.qll'
9+
- '*/ql/lib/**/*.ql'
10+
- '*/ql/lib/**/*.qll'
11+
- 'misc/scripts/library-coverage/*.py'
12+
# input data files
13+
- '*/documentation/library-coverage/cwe-sink.csv'
14+
- '*/documentation/library-coverage/frameworks.csv'
15+
branches:
16+
- main
17+
- 'rc/*'
18+
19+
jobs:
20+
generate:
21+
name: Generate framework coverage artifacts
22+
23+
runs-on: ubuntu-latest
24+
25+
steps:
26+
- name: Dump GitHub context
27+
env:
28+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
29+
run: echo "$GITHUB_CONTEXT"
30+
- name: Clone self (github/codeql) - MERGE
31+
uses: actions/checkout@v2
32+
with:
33+
path: merge
34+
- name: Clone self (github/codeql) - BASE
35+
uses: actions/checkout@v2
36+
with:
37+
fetch-depth: 2
38+
path: base
39+
- run: |
40+
git checkout HEAD^1
41+
git log -1 --format='%H'
42+
working-directory: base
43+
- name: Set up Python 3.8
44+
uses: actions/setup-python@v2
45+
with:
46+
python-version: 3.8
47+
- name: Download CodeQL CLI
48+
env:
49+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
50+
run: |
51+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
52+
- name: Unzip CodeQL CLI
53+
run: unzip -d codeql-cli codeql-linux64.zip
54+
- name: Generate CSV files on merge commit of the PR
55+
run: |
56+
echo "Running generator on merge"
57+
PATH="$PATH:codeql-cli/codeql" python merge/misc/scripts/library-coverage/generate-report.py ci merge merge
58+
mkdir out_merge
59+
cp framework-coverage-*.csv out_merge/
60+
cp framework-coverage-*.rst out_merge/
61+
- name: Generate CSV files on base commit of the PR
62+
run: |
63+
echo "Running generator on base"
64+
PATH="$PATH:codeql-cli/codeql" python base/misc/scripts/library-coverage/generate-report.py ci base base
65+
mkdir out_base
66+
cp framework-coverage-*.csv out_base/
67+
cp framework-coverage-*.rst out_base/
68+
- name: Generate diff of coverage reports
69+
run: |
70+
python base/misc/scripts/library-coverage/compare-folders.py out_base out_merge comparison.md
71+
- name: Upload CSV package list
72+
uses: actions/upload-artifact@v2
73+
with:
74+
name: csv-framework-coverage-merge
75+
path: |
76+
out_merge/framework-coverage-*.csv
77+
out_merge/framework-coverage-*.rst
78+
- name: Upload CSV package list
79+
uses: actions/upload-artifact@v2
80+
with:
81+
name: csv-framework-coverage-base
82+
path: |
83+
out_base/framework-coverage-*.csv
84+
out_base/framework-coverage-*.rst
85+
- name: Upload comparison results
86+
uses: actions/upload-artifact@v2
87+
with:
88+
name: comparison
89+
path: |
90+
comparison.md
91+
- name: Save PR number
92+
run: |
93+
mkdir -p pr
94+
echo ${{ github.event.pull_request.number }} > pr/NR
95+
- name: Upload PR number
96+
uses: actions/upload-artifact@v2
97+
with:
98+
name: pr
99+
path: pr/

0 commit comments

Comments
 (0)