CodeQL: Setting paths in Github Advanced Security for Azure Devops
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
I'm using Github Advanced Security in Azure devops in a monorepo. With the given folder structure:
```
.
└── apps/
├── frontend/
│ ├── green-app
│ └── red-app
└── backend/
├── green-app
└── red-app
```
By default the codeql task will scan the ENTIRE code base. Which is not what I want.
**How can I configure Github advanced security to only scan one project? For example the front-end and backend folder for the green-app.**
I tried setting the sources folder to the back-end folder. But then I'm not able to "reach" the front-end folder when I set the codeqlpathstoinclude parameter. When I try this:
```
- task: AdvancedSecurity-Codeql-Init@1
condition: and(succeededOrFailed(), ${{parameters.runGithubAdvancedSecurity}})
displayName: 'Github Advanced Security: Initialize 🛡'
inputs:
languages: 'csharp,javascript'
sourcesfolder: '$(System.DefaultWorkingDirectory)/apps/backend/green-app'
codeqlpathstoinclude: '../frontend/green-app'
```
_(Following the [docs](https://learn-microsoft-com.translate.goog/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-init-v1?view=azure-pipelines&_x_tr_sl=en&_x_tr_tl=nl&_x_tr_hl=nl&_x_tr_pto=sc): "The paths must be relative to the sourcesfolder where CodeQL is running, which defaults to the Build.SourcesDirectory pipeline environment variable. For example, to include the $(Build.SourcesDirectory)/app directory, set codeqlpathstoinclude: app rather than codeqlpathstoinclude: $(Build.SourcesDirectory)/app.")_
I get:
> Only found JavaScript or TypeScript files that were empty or contained syntax errors
Wildcards are also giving issues:
`apps/*/green-app/**/*`
What am I doing wrong here? Any other way i can accomplish this?
贡献指南
调研方向
从 AdvancedSecurity-Codeql-Init@1 管道任务文档以及其中显示的 sourcesfolder 和 codeqlpathstoinclude 设置开始。验证相对路径和通配符的解析方式,然后确认仅扫描 green-app 的前端和后端路径,且不会出现报告中的 JavaScript 或 TypeScript 错误。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- azure, csharp, javascript
- 领域
- devops, security
- Issue 类型
- 缺陷
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100