Skip to content

Commit a70ce25

Browse files
author
Dave Bartolomeo
authored
Merge pull request github#17850 from github/dbartol/actions-placeholder
Implement Actions extractor and placeholder Actions QL packs
2 parents 41df9ae + 3228447 commit a70ce25

File tree

16 files changed

+225
-0
lines changed

16 files changed

+225
-0
lines changed

‎.github/labeler.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ Swift:
3838
- swift/**/*
3939
- change-notes/**/*swift*
4040

41+
Actions:
42+
- actions/**/*
43+
- change-notes/**/*actions*
44+
4145
documentation:
4246
- "**/*.qhelp"
4347
- "**/*.md"

‎actions/extractor/codeql-extractor.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: "actions"
2+
aliases: []
3+
display_name: "GitHub Actions"
4+
version: 0.0.1
5+
column_kind: "utf16"
6+
unicode_newlines: true
7+
build_modes:
8+
- none
9+
file_coverage_languages: []
10+
github_api_languages: []
11+
scc_languages: []
12+
file_types:
13+
- name: workflow
14+
display_name: GitHub Actions workflow files
15+
extensions:
16+
- .yml
17+
- .yaml
18+
forwarded_extractor_name: javascript
19+
options:
20+
trap:
21+
title: TRAP options
22+
description: Options about how the extractor handles TRAP files
23+
type: object
24+
visibility: 3
25+
properties:
26+
cache:
27+
title: TRAP cache options
28+
description: Options about how the extractor handles its TRAP cache
29+
type: object
30+
properties:
31+
dir:
32+
title: TRAP cache directory
33+
description: The directory of the TRAP cache to use
34+
type: string
35+
bound:
36+
title: TRAP cache bound
37+
description: A soft limit (in MB) on the size of the TRAP cache
38+
type: string
39+
pattern: "[0-9]+"
40+
write:
41+
title: TRAP cache writeable
42+
description: Whether to write to the TRAP cache as well as reading it
43+
type: string
44+
pattern: "(true|TRUE|false|FALSE)"

‎actions/extractor/tools/autobuild-impl.ps1

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
if (($null -ne $env:LGTM_INDEX_INCLUDE) -or ($null -ne $env:LGTM_INDEX_EXCLUDE) -or ($null -ne $env:LGTM_INDEX_FILTERS)) {
2+
Write-Output 'Path filters set. Passing them through to the JavaScript extractor.'
3+
} else {
4+
Write-Output 'No path filters set. Using the default filters.'
5+
$DefaultPathFilters = @(
6+
'exclude:**/*',
7+
'include:.github/workflows/**/*.yml',
8+
'include:.github/workflows/**/*.yaml',
9+
'include:**/action.yml',
10+
'include:**/action.yaml'
11+
)
12+
13+
$env:LGTM_INDEX_FILTERS = $DefaultPathFilters -join "`n"
14+
}
15+
16+
# Find the JavaScript extractor directory via `codeql resolve extractor`.
17+
$CodeQL = Join-Path $env:CODEQL_DIST 'codeql.exe'
18+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_ROOT = &$CodeQL resolve extractor --language javascript
19+
if ($LASTEXITCODE -ne 0) {
20+
throw 'Failed to resolve JavaScript extractor.'
21+
}
22+
23+
Write-Output "Found JavaScript extractor at '${env:CODEQL_EXTRACTOR_JAVASCRIPT_ROOT}'."
24+
25+
# Run the JavaScript autobuilder.
26+
$JavaScriptAutoBuild = Join-Path $env:CODEQL_EXTRACTOR_JAVASCRIPT_ROOT 'tools\autobuild.cmd'
27+
Write-Output "Running JavaScript autobuilder at '${JavaScriptAutoBuild}'."
28+
29+
# Copy the values of the Actions extractor environment variables to the JavaScript extractor environment variables.
30+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_DIAGNOSTIC_DIR = $env:CODEQL_EXTRACTOR_ACTIONS_DIAGNOSTIC_DIR
31+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_LOG_DIR = $env:CODEQL_EXTRACTOR_ACTIONS_LOG_DIR
32+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_SCRATCH_DIR = $env:CODEQL_EXTRACTOR_ACTIONS_SCRATCH_DIR
33+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_SOURCE_ARCHIVE_DIR = $env:CODEQL_EXTRACTOR_ACTIONS_SOURCE_ARCHIVE_DIR
34+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR = $env:CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR
35+
$env:CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE = $env:CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE
36+
37+
&$JavaScriptAutoBuild
38+
if ($LASTEXITCODE -ne 0) {
39+
throw "JavaScript autobuilder failed."
40+
}

‎actions/extractor/tools/autobuild.cmd

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
@echo off
2+
rem All of the work is done in the PowerShell script
3+
powershell.exe %~dp0autobuild-impl.ps1

‎actions/extractor/tools/autobuild.sh

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/sh
2+
3+
set -eu
4+
5+
DEFAULT_PATH_FILTERS=$(cat << END
6+
exclude:**/*
7+
include:.github/workflows/**/*.yml
8+
include:.github/workflows/**/*.yaml
9+
include:**/action.yml
10+
include:**/action.yaml
11+
END
12+
)
13+
14+
if [ -n "${LGTM_INDEX_INCLUDE}" ] || [ -n "${LGTM_INDEX_EXCLUDE}" ] || [ -n "${LGTM_INDEX_FILTERS}" ] ; then
15+
echo "Path filters set. Passing them through to the JavaScript extractor."
16+
else
17+
echo "No path filters set. Using the default filters."
18+
LGTM_INDEX_FILTERS="${DEFAULT_PATH_FILTERS}"
19+
export LGTM_INDEX_FILTERS
20+
fi
21+
22+
# Find the JavaScript extractor directory via `codeql resolve extractor`.
23+
CODEQL_EXTRACTOR_JAVASCRIPT_ROOT="$($CODEQL_DIST/codeql resolve extractor --language javascript)"
24+
export CODEQL_EXTRACTOR_JAVASCRIPT_ROOT
25+
26+
echo "Found JavaScript extractor at '${CODEQL_EXTRACTOR_JAVASCRIPT_ROOT}'."
27+
28+
# Run the JavaScript autobuilder
29+
JAVASCRIPT_AUTO_BUILD="${CODEQL_EXTRACTOR_JAVASCRIPT_ROOT}/tools/autobuild.sh"
30+
echo "Running JavaScript autobuilder at '${JAVASCRIPT_AUTO_BUILD}'."
31+
32+
# Copy the values of the Actions extractor environment variables to the JavaScript extractor environment variables.
33+
env CODEQL_EXTRACTOR_JAVASCRIPT_DIAGNOSTIC_DIR="${CODEQL_EXTRACTOR_ACTIONS_DIAGNOSTIC_DIR}" \
34+
CODEQL_EXTRACTOR_JAVASCRIPT_LOG_DIR="${CODEQL_EXTRACTOR_ACTIONS_LOG_DIR}" \
35+
CODEQL_EXTRACTOR_JAVASCRIPT_SCRATCH_DIR="${CODEQL_EXTRACTOR_ACTIONS_SCRATCH_DIR}" \
36+
CODEQL_EXTRACTOR_JAVASCRIPT_SOURCE_ARCHIVE_DIR="${CODEQL_EXTRACTOR_ACTIONS_SOURCE_ARCHIVE_DIR}" \
37+
CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR="${CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR}" \
38+
CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE="${CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE}" \
39+
${JAVASCRIPT_AUTO_BUILD}

‎actions/ql/lib/actions.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
predicate placeholder(int x) { x = 0 }

‎actions/ql/lib/qlpack.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: codeql/actions-all
2+
version: 0.0.1-dev
3+
library: true
4+
warnOnImplicitThis: true
5+
dependencies:
6+
codeql/util: ${workspace}
7+
codeql/yaml: ${workspace}
8+
codeql/controlflow: ${workspace}
9+
codeql/dataflow: ${workspace}
10+
codeql/javascript-all: ${workspace}
11+
extractor: actions
12+
groups: actions

‎actions/ql/src/Placeholder.ql

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/**
2+
* @name Placeholder Query
3+
* @description Placeholder
4+
* @kind problem
5+
* @problem.severity warning
6+
* @security-severity 9.3
7+
* @precision high
8+
* @id actions/placeholder
9+
* @tags actions security
10+
*/
11+
12+
import actions
13+
import javascript
14+
15+
from File f
16+
select f, "Analyzed a file."

‎actions/ql/src/qlpack.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
name: codeql/actions-queries
2+
version: 0.0.1-dev
3+
library: false
4+
groups: [actions, queries]
5+
extractor: actions
6+
dependencies:
7+
codeql/actions-all: ${workspace}
8+
warnOnImplicitThis: true

‎actions/ql/test/library-tests/.github/workflows/shell.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
on: push
2+
3+
jobs:
4+
job1:
5+
runs-on: ubuntu-latest
6+
steps:
7+
- shell: pwsh
8+
run: Write-Output "foo"
9+
job2:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- run: echo "foo"
13+
14+
job3:
15+
runs-on: windows-latest
16+
steps:
17+
- shell: bash
18+
run: echo "foo"
19+
job4:
20+
runs-on: windows-latest
21+
steps:
22+
- run: Write-Output "foo"
23+

0 commit comments

Comments
 (0)