github / github/codeql

CodeQL: Setting paths in Github Advanced Security for Azure Devops

オープン
#18,372 コメント 6 件 リアクション 0 件 担当者 0 名 GitHub で見る
question
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

I'm using Github Advanced Security in Azure devops in a monorepo. With the given folder structure:

```
.
└── apps/
├── frontend/
│ ├── green-app
│ └── red-app
└── backend/
├── green-app
└── red-app
```

By default the codeql task will scan the ENTIRE code base. Which is not what I want.

**How can I configure Github advanced security to only scan one project? For example the front-end and backend folder for the green-app.**

I tried setting the sources folder to the back-end folder. But then I'm not able to "reach" the front-end folder when I set the codeqlpathstoinclude parameter. When I try this:
```
- task: AdvancedSecurity-Codeql-Init@1
condition: and(succeededOrFailed(), ${{parameters.runGithubAdvancedSecurity}})
displayName: 'Github Advanced Security: Initialize 🛡'
inputs:
languages: 'csharp,javascript'
sourcesfolder: '$(System.DefaultWorkingDirectory)/apps/backend/green-app'
codeqlpathstoinclude: '../frontend/green-app'
```
_(Following the [docs](https://learn-microsoft-com.translate.goog/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-init-v1?view=azure-pipelines&_x_tr_sl=en&_x_tr_tl=nl&_x_tr_hl=nl&_x_tr_pto=sc): "The paths must be relative to the sourcesfolder where CodeQL is running, which defaults to the Build.SourcesDirectory pipeline environment variable. For example, to include the $(Build.SourcesDirectory)/app directory, set codeqlpathstoinclude: app rather than codeqlpathstoinclude: $(Build.SourcesDirectory)/app.")_

I get:
> Only found JavaScript or TypeScript files that were empty or contained syntax errors

Wildcards are also giving issues:
`apps/*/green-app/**/*`

What am I doing wrong here? Any other way i can accomplish this?

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

Start with the AdvancedSecurity-Codeql-Init@1 pipeline task documentation and the shown sourcesfolder and codeqlpathstoinclude settings. Verify how relative paths and wildcards are resolved, then confirm that only the green-app frontend and backend paths are scanned without the reported JavaScript or TypeScript errors.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
azure, csharp, javascript
領域
devops, security
issue の種類
バグ
難易度
3/5
見積もり時間
1〜2日
活発さ
停滞
明瞭さ
おおむね明確
初心者へのやさしさ
35/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。