Skip to content

Commit 3d1f752

Browse files
committed
address @henrymercer's comments
1 parent 44bf818 commit 3d1f752

File tree

1 file changed

+12
-35
lines changed

1 file changed

+12
-35
lines changed
Lines changed: 12 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,15 @@
11
name: ATM Check Queries Run
22

33
env:
4-
AZURE_STORAGE_URL: "https://atmcodeqldata.blob.core.windows.net"
5-
DB_NAME: "AmanSultanBaig/SignIn-SignUp-System-with-Nodejs"
64
DB_PATH: test_db
7-
MODEL_BULDING_PACK_PATH: javascript/ql/experimental/adaptivethreatmodeling/modelbuilding
8-
QUERY_SUITE: javascript/ql/experimental/adaptivethreatmodeling/src/codeql-suites/javascript-atm-code-scanning.qls
5+
ATM_MODEL_PACK: javascript/ql/experimental/adaptivethreatmodeling/src
6+
QUERY_SUITE: codeql-suites/javascript-atm-code-scanning.qls
97

108
on:
119
pull_request:
1210
paths:
13-
- "javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/codeql-pack.lock.yml"
14-
- "javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml"
15-
- "javascript/experimental/adpativethreatmodeling/src/qlpack.yml"
16-
- "javascript/experimental/adpativethreatmodeling/src/codeql-pack.lock.yml"
11+
- ".github/workflows/atm-check-queries-run.yml"
12+
- "javascript/ql/experimental/adaptivethreatmodeling/**"
1713
workflow_dispatch:
1814

1915
jobs:
@@ -22,8 +18,6 @@ jobs:
2218

2319
steps:
2420
- uses: actions/checkout@v3
25-
with:
26-
path: codeql-lib
2721

2822
- name: Install CodeQL CLI
2923
env:
@@ -32,48 +26,31 @@ jobs:
3226
gh extensions install github/gh-codeql
3327
gh codeql download
3428
35-
- name: Download model pack
29+
- name: Install ATM model pack
3630
env:
3731
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38-
STORAGE_SAS: ${{ secrets.AZURE_BLOB_STORAGE_ATMCODEQLDATA_SAS }}
3932
run: |
40-
echo "::group::Download ATM model pack"
4133
set -exu
34+
35+
# Install ATM model pack
36+
gh codeql pack install ${ATM_MODEL_PACK}
4237
43-
# Get pack version and checksum
44-
pack_version=$(yq '.dependencies.codeql/javascript-experimental-atm-model' ./codeql-lib/${MODEL_BULDING_PACK_PATH}/qlpack.yml )
45-
model_checksum="${pack_version##*.}"
46-
echo "Will use pack model ${pack_version} with model checksum ${model_checksum}."
47-
48-
# Download the model to the package cache
49-
tmp_dir=$(mktemp -d)
50-
gh codeql pack download codeql/javascript-experimental-atm-model@${pack_version}
38+
# Retrieve model checksum
39+
model_checksum=$(gh codeql resolve extensions ${ATM_MODEL_PACK}/${QUERY_SUITE} | jq -r '.models[0].checksum')
5140
5241
# Trust the model so that we can use it in the ATM boosted queries
5342
mkdir -p "$HOME/.config/codeql"
5443
echo "--insecurely-execute-ml-model-checksums ${model_checksum}" >> "$HOME/.config/codeql/config"
55-
echo "::endgroup::"
5644
5745
- name: Create test DB
5846
env:
5947
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6048
run: |
61-
echo "::group::Create test database"
62-
gh repo clone ${DB_NAME} -- --depth 1
63-
gh codeql database create ${DB_PATH} --language javascript
64-
echo "::endgroup::"
49+
gh codeql database create ${RUNNER_TEMP}/${DB_PATH} --source-root config/atm/ --language javascript
6550
6651
- name: Run ATM query suite
6752
env:
6853
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6954
run: |
70-
echo "::group::Run boosted query suite"
71-
gh codeql database run-queries -vv -- ${DB_PATH} codeql-lib/${QUERY_SUITE}
72-
if [[ $? -ne 0 ]]; then
73-
echo "Failed to run the ATM query suite."
74-
exit 1
75-
else
76-
echo "Successfully run ATM query suite."
77-
fi
78-
echo "::endgroup::"
55+
gh codeql database run-queries -vv -- ${RUNNER_TEMP}/${DB_PATH} ${ATM_MODEL_PACK}/${QUERY_SUITE}
7956

0 commit comments

Comments
 (0)