1
1
name : ATM Check Queries Run
2
2
3
3
env :
4
- AZURE_STORAGE_URL : " https://atmcodeqldata.blob.core.windows.net"
5
- DB_NAME : " AmanSultanBaig/SignIn-SignUp-System-with-Nodejs"
6
4
DB_PATH : test_db
7
- MODEL_BULDING_PACK_PATH : javascript/ql/experimental/adaptivethreatmodeling/modelbuilding
8
- QUERY_SUITE : javascript/ql/experimental/adaptivethreatmodeling/src/ codeql-suites/javascript-atm-code-scanning.qls
5
+ ATM_MODEL_PACK : javascript/ql/experimental/adaptivethreatmodeling/src
6
+ QUERY_SUITE : codeql-suites/javascript-atm-code-scanning.qls
9
7
10
8
on :
11
9
pull_request :
12
10
paths :
13
- - " javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/codeql-pack.lock.yml"
14
- - " javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml"
15
- - " javascript/experimental/adpativethreatmodeling/src/qlpack.yml"
16
- - " javascript/experimental/adpativethreatmodeling/src/codeql-pack.lock.yml"
11
+ - " .github/workflows/atm-check-queries-run.yml"
12
+ - " javascript/ql/experimental/adaptivethreatmodeling/**"
17
13
workflow_dispatch :
18
14
19
15
jobs :
22
18
23
19
steps :
24
20
- uses : actions/checkout@v3
25
- with :
26
- path : codeql-lib
27
21
28
22
- name : Install CodeQL CLI
29
23
env :
@@ -32,48 +26,31 @@ jobs:
32
26
gh extensions install github/gh-codeql
33
27
gh codeql download
34
28
35
- - name : Download model pack
29
+ - name : Install ATM model pack
36
30
env :
37
31
GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
38
- STORAGE_SAS : ${{ secrets.AZURE_BLOB_STORAGE_ATMCODEQLDATA_SAS }}
39
32
run : |
40
- echo "::group::Download ATM model pack"
41
33
set -exu
34
+
35
+ # Install ATM model pack
36
+ gh codeql pack install ${ATM_MODEL_PACK}
42
37
43
- # Get pack version and checksum
44
- pack_version=$(yq '.dependencies.codeql/javascript-experimental-atm-model' ./codeql-lib/${MODEL_BULDING_PACK_PATH}/qlpack.yml )
45
- model_checksum="${pack_version##*.}"
46
- echo "Will use pack model ${pack_version} with model checksum ${model_checksum}."
47
-
48
- # Download the model to the package cache
49
- tmp_dir=$(mktemp -d)
50
- gh codeql pack download codeql/javascript-experimental-atm-model@${pack_version}
38
+ # Retrieve model checksum
39
+ model_checksum=$(gh codeql resolve extensions ${ATM_MODEL_PACK}/${QUERY_SUITE} | jq -r '.models[0].checksum')
51
40
52
41
# Trust the model so that we can use it in the ATM boosted queries
53
42
mkdir -p "$HOME/.config/codeql"
54
43
echo "--insecurely-execute-ml-model-checksums ${model_checksum}" >> "$HOME/.config/codeql/config"
55
- echo "::endgroup::"
56
44
57
45
- name : Create test DB
58
46
env :
59
47
GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
60
48
run : |
61
- echo "::group::Create test database"
62
- gh repo clone ${DB_NAME} -- --depth 1
63
- gh codeql database create ${DB_PATH} --language javascript
64
- echo "::endgroup::"
49
+ gh codeql database create ${RUNNER_TEMP}/${DB_PATH} --source-root config/atm/ --language javascript
65
50
66
51
- name : Run ATM query suite
67
52
env :
68
53
GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
69
54
run : |
70
- echo "::group::Run boosted query suite"
71
- gh codeql database run-queries -vv -- ${DB_PATH} codeql-lib/${QUERY_SUITE}
72
- if [[ $? -ne 0 ]]; then
73
- echo "Failed to run the ATM query suite."
74
- exit 1
75
- else
76
- echo "Successfully run ATM query suite."
77
- fi
78
- echo "::endgroup::"
55
+ gh codeql database run-queries -vv -- ${RUNNER_TEMP}/${DB_PATH} ${ATM_MODEL_PACK}/${QUERY_SUITE}
79
56
0 commit comments