github / github/codeql

CodeQL: Setting paths in Github Advanced Security for Azure Devops

未关闭
#18,372 6 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

I'm using Github Advanced Security in Azure devops in a monorepo. With the given folder structure:

```
.
└── apps/
├── frontend/
│ ├── green-app
│ └── red-app
└── backend/
├── green-app
└── red-app
```

By default the codeql task will scan the ENTIRE code base. Which is not what I want.

**How can I configure Github advanced security to only scan one project? For example the front-end and backend folder for the green-app.**

I tried setting the sources folder to the back-end folder. But then I'm not able to "reach" the front-end folder when I set the codeqlpathstoinclude parameter. When I try this:
```
- task: AdvancedSecurity-Codeql-Init@1
condition: and(succeededOrFailed(), ${{parameters.runGithubAdvancedSecurity}})
displayName: 'Github Advanced Security: Initialize 🛡'
inputs:
languages: 'csharp,javascript'
sourcesfolder: '$(System.DefaultWorkingDirectory)/apps/backend/green-app'
codeqlpathstoinclude: '../frontend/green-app'
```
_(Following the [docs](https://learn-microsoft-com.translate.goog/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-init-v1?view=azure-pipelines&_x_tr_sl=en&_x_tr_tl=nl&_x_tr_hl=nl&_x_tr_pto=sc): "The paths must be relative to the sourcesfolder where CodeQL is running, which defaults to the Build.SourcesDirectory pipeline environment variable. For example, to include the $(Build.SourcesDirectory)/app directory, set codeqlpathstoinclude: app rather than codeqlpathstoinclude: $(Build.SourcesDirectory)/app.")_

I get:
> Only found JavaScript or TypeScript files that were empty or contained syntax errors

Wildcards are also giving issues:
`apps/*/green-app/**/*`

What am I doing wrong here? Any other way i can accomplish this?

贡献指南

打开贡献指南

调研方向

从 AdvancedSecurity-Codeql-Init@1 管道任务文档以及其中显示的 sourcesfolder 和 codeqlpathstoinclude 设置开始。验证相对路径和通配符的解析方式,然后确认仅扫描 green-app 的前端和后端路径,且不会出现报告中的 JavaScript 或 TypeScript 错误。

由索引模型根据 Issue 内容生成。

评估

技术栈
azure, csharp, javascript
领域
devops, security
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。