Skip to content

Commit ccf7e17

Browse files
GeekMasherGeekMasher
authored
Merge branch 'main' into tf/azure-storage-account
2 parents 660cfa8 + f693b3d commit ccf7e17

File tree

147 files changed

+2672
-3889
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

147 files changed

+2672
-3889
lines changed

‎.all-contributorsrc‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,15 @@
5656
"design",
5757
"ideas"
5858
]
59+
},
60+
{
61+
"login": "ViktorLindstrm",
62+
"name": "Viktor Lindström",
63+
"avatar_url": "https://avatars.githubusercontent.com/u/3715582?v=4",
64+
"profile": "https://github.com/ViktorLindstrm",
65+
"contributions": [
66+
"code"
67+
]
5968
}
6069
]
61-
}
70+
}

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
# This project is maintained with love by:
1+
# This project is maintained with love by
22

3-
- @geekmasher
3+
- @advanced-security/oss-maintainers

‎.github/action/dist/index.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13530,7 +13530,7 @@ const toolcache = __importStar(__nccwpck_require__(7784));
1353013530
const github = __importStar(__nccwpck_require__(5438));
1353113531
const toolrunner = __importStar(__nccwpck_require__(8159));
1353213532
exports.EXTRACTOR_REPOSITORY = "advanced-security/codeql-extractor-iac";
13533-
exports.EXTRACTOR_VERSION = "v0.4.0"; // stable version
13533+
exports.EXTRACTOR_VERSION = "v0.4.1"; // stable version
1353413534
async function newCodeQL() {
1353513535
var version = core.getInput("extractor-version");
1353613536
if (version === "") {

‎.github/action/package-lock.json‎

Lines changed: 260 additions & 215 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/action/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
"dependencies": {
3737
"@actions/core": "^1.10.1",
3838
"@actions/exec": "^1.1.1",
39-
"@actions/github": "^5.1.1",
39+
"@actions/github": "^6.0.0",
4040
"@actions/tool-cache": "^2.0.1"
4141
},
4242
"devDependencies": {

‎.github/action/src/codeql.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import * as github from "@actions/github";
77
import * as toolrunner from "@actions/exec/lib/toolrunner";
88

99
export const EXTRACTOR_REPOSITORY = "advanced-security/codeql-extractor-iac";
10-
export const EXTRACTOR_VERSION = "v0.4.0"; // stable version
10+
export const EXTRACTOR_VERSION = "v0.5.0"; // stable version
1111

1212
export interface CodeQLConfig {
1313
// The path to the codeql bundle.

‎.github/dependabot.yml‎

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,38 @@
55

66
version: 2
77
updates:
8-
- package-ecosystem: "cargo"
8+
- package-ecosystem: "github-actions"
99
directory: "/"
1010
schedule:
1111
interval: "weekly"
1212
reviewers:
13-
- "geekmasher"
13+
- "advanced-security/oss-maintainers"
14+
target-branch: "main"
15+
commit-message:
16+
prefix: deps
17+
prefix-development: chore
18+
labels:
19+
- "Dependencies"
1420
groups:
15-
extractor:
21+
production-dependencies:
1622
dependency-type: "production"
23+
development-dependencies:
24+
dependency-type: "development"
1725

18-
- package-ecosystem: "github-actions"
26+
- package-ecosystem: "cargo"
1927
directory: "/"
2028
schedule:
2129
interval: "weekly"
2230
reviewers:
23-
- "geekmasher"
31+
- "advanced-security/oss-maintainers"
32+
target-branch: "main"
33+
commit-message:
34+
prefix: deps
35+
prefix-development: chore
36+
labels:
37+
- "Dependencies"
38+
groups:
39+
production-dependencies:
40+
dependency-type: "production"
41+
development-dependencies:
42+
dependency-type: "development"

‎.github/workflows/build.yml‎

Lines changed: 88 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ jobs:
1818
test-folders: ["library-tests", "queries-tests"]
1919
steps:
2020
- name: "Checkout"
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@v5
22+
with:
23+
submodules: true
2224

2325
- name: "Check for changes"
24-
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
26+
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
2527
id: extractor-changes
2628
with:
2729
filters: |
@@ -35,6 +37,7 @@ jobs:
3537
env:
3638
GH_TOKEN: ${{ github.token }}
3739
run: |
40+
set -e
3841
gh release list -L 1 -R "advanced-security/codeql-extractor-iac"
3942
4043
gh release download \
@@ -44,14 +47,18 @@ jobs:
4447
4548
tar -zxf extractor-iac.tar.gz
4649
47-
- uses: dtolnay/rust-toolchain@nightly
50+
chmod +x extractor-pack/tools/*.sh
51+
chmod +x extractor-pack/tools/**/*
52+
53+
- uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
4854
if: steps.extractor-changes.outputs.src == 'true'
4955

5056
- name: "Build Extractor"
5157
if: steps.extractor-changes.outputs.src == 'true'
5258
env:
5359
GH_TOKEN: ${{ github.token }}
5460
run: |
61+
set -e
5562
gh extensions install github/gh-codeql
5663
gh codeql set-version latest
5764
@@ -65,11 +72,87 @@ jobs:
6572
run: |
6673
./scripts/run-tests.sh "ql/test/${{ matrix.test-folders }}"
6774
75+
# scanning:
76+
# runs-on: ubuntu-latest
77+
# needs: [tests]
78+
79+
# strategy:
80+
# matrix:
81+
# # project: ["hashicorp/terraform-guides", "akamai/terraform-examples", "aws-samples/aws-sam-terraform-examples"]
82+
# project: []
83+
84+
# steps:
85+
# - name: "Checkout"
86+
# uses: actions/checkout@v5
87+
# with:
88+
# submodules: true
89+
90+
# - name: "Checkout"
91+
# uses: actions/checkout@v5
92+
# with:
93+
# repository: ${{ matrix.project }}
94+
# path: project
95+
96+
# - name: "Check for changes"
97+
# uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
98+
# id: extractor-changes
99+
# with:
100+
# filters: |
101+
# src:
102+
# - 'extractor/**'
103+
# - 'rust-toolchain.toml'
104+
# - 'Cargo.*'
105+
106+
# - name: "Download Extracter"
107+
# if: steps.extractor-changes.outputs.src == 'false'
108+
# env:
109+
# GH_TOKEN: ${{ github.token }}
110+
# run: |
111+
# set -e
112+
# gh release list -L 1 -R "advanced-security/codeql-extractor-iac"
113+
114+
# gh release download \
115+
# -R "advanced-security/codeql-extractor-iac" \
116+
# --clobber \
117+
# --pattern 'extractor-iac.tar.gz'
118+
119+
# tar -zxf extractor-iac.tar.gz
120+
121+
# - uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
122+
# if: steps.extractor-changes.outputs.src == 'true'
123+
124+
# - name: "Build Extractor"
125+
# if: steps.extractor-changes.outputs.src == 'true'
126+
# env:
127+
# GH_TOKEN: ${{ github.token }}
128+
# run: |
129+
# set -e
130+
# gh extensions install github/gh-codeql
131+
# gh codeql set-version latest
132+
133+
# ./scripts/create-extractor-pack.sh
134+
135+
# gh codeql resolve languages --format=json --search-path ./extractor-pack
136+
137+
# - name: "Run CodeQL Analysis"
138+
# env:
139+
# GH_TOKEN: ${{ github.token }}
140+
# PROJECT_REPO: ${{ matrix.project }}
141+
# run: |
142+
# set -e
143+
# gh extensions install github/gh-codeql
144+
# gh codeql set-version latest
145+
146+
# gh codeql database create --language=iac --source-root=./project --search-path ./extractor-pack iac-db
147+
148+
# gh codeql database analyze --search-path ./extractor-pack --format sarif-latest --output="iac-${PROJECT_REPO}.sarif" iac-db ./ql/src
149+
150+
68151
docs:
69152
runs-on: ubuntu-latest
70153
steps:
71-
- uses: actions/checkout@v4
72-
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
154+
- uses: actions/checkout@v5
155+
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
73156
id: changes
74157
with:
75158
filters: |
@@ -81,21 +164,3 @@ jobs:
81164
run: |
82165
npm install -g markdownlint-cli
83166
markdownlint '**.md' --ignore node_modules --disable MD013
84-
85-
action:
86-
runs-on: ubuntu-latest
87-
steps:
88-
- uses: actions/checkout@v4
89-
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
90-
id: changes
91-
with:
92-
filters: |
93-
src:
94-
- '.github/action/**'
95-
- 'action.yml'
96-
97-
- name: Run action
98-
if: steps.changes.outputs.src == 'true'
99-
uses: ./
100-
with:
101-
extractor-version: latest

‎.github/workflows/copilot-setup-steps.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
name: "Copilot Setup Steps"
3+
4+
# Automatically run the setup steps when they are changed to allow for
5+
# easy validation, and manual testing through the repository's Actions tab
6+
on:
7+
workflow_dispatch: {}
8+
push:
9+
paths:
10+
- .github/workflows/copilot-setup-steps.yml
11+
pull_request:
12+
paths:
13+
- .github/workflows/copilot-setup-steps.yml
14+
15+
jobs:
16+
# The job MUST be called `copilot-setup-steps` or it will not be picked up
17+
# by Copilot.
18+
copilot-setup-steps:
19+
runs-on: ubuntu-latest
20+
21+
# Set the permissions to the lowest permissions possible needed for your
22+
# steps. Copilot will be given its own token for its operations.
23+
permissions:
24+
# If you want to clone the repository as part of your setup steps, for
25+
# example to install dependencies, you'll need the `contents: read`
26+
# permission. If you don't clone the repository in your setup steps,
27+
# Copilot will do this for you automatically after the steps complete.
28+
contents: read
29+
30+
# You can define any steps you want, and they will run before the agent
31+
# starts. If you do not check out your code, Copilot will do this for you.
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v4
35+
with:
36+
submodules: true
37+
38+
- name: Install GitHub CLI CodeQL extension
39+
env:
40+
GH_TOKEN: ${{ github.token }}
41+
run: |
42+
# Install GitHub CLI (should already be available in ubuntu-latest)
43+
gh --version
44+
45+
# Install CodeQL CLI extension
46+
gh extension install github/gh-codeql
47+
48+
# Set CodeQL to latest version
49+
gh codeql set-version latest
50+
51+
# Verify the extension is installed and working
52+
gh codeql version
53+
54+
# Install packs
55+
(cd ./ql/src/ && gh codeql pack install)
56+
(cd ./ql/lib/ && gh codeql pack install)
57+
(cd ./ql/test/ && gh codeql pack install)

‎.github/workflows/coverage.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,12 @@ on:
88
jobs:
99
coverage:
1010
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
actions: write
1114

1215
steps:
13-
- uses: actions/checkout@v4
16+
- uses: actions/checkout@v5
1417

1518
- name: "Run Coverage Report"
1619
if: github.ref == 'refs/heads/main'

0 commit comments

Comments
 (0)