CodeQL analyze error with exit code 2: running specific queries using a query suite #430
Comments
|
Thanks for letting us know. Do you have the remaining logs from the CodeQL workflow? This exit code indicates CodeQL itself failed in the analysis step, and it will usually print the error logs to stderr (docs). Try enabling Actions debug logging and running the workflow again. Then if your repository is public please share a link to the Actions run, otherwise we may ask you to share the logs in this issue or in a support ticket. |
|
Sorry for the delayed response. Unfortunately, I can't share the repository with you guys as it is a private repo. |
|
Thanks. That looks like you're running queries from the If you're trying to run the experimental queries, then I can show you how to run additional queries by checking in a query suite file and tweaking the configuration, instead of fetching from |
codeql.ymlname: "OPN CodeQL config"
queries:
- uses: security-and-quality
- uses: github/codeql-go/ql/src/experimental@mainworkflow filename: "CodeQL"
on:
push:
branches: [master]
pull_request:
# The branches below must be a subset of the branches above
branches: [master]
schedule:
- cron: '0 4 * * 3'
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
language: ['go']
steps:
- name: Checkout repository
uses: actions/checkout@v2
with:
fetch-depth: 2
- run: git checkout HEAD^2
if: ${{ github.event_name == 'pull_request' }}
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v1
with:
languages: ${{ matrix.language }}
config-file: ./.github/codeql.yml
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
# queries: ./path/to/local/query, your-org/your-repo/queries@main
- name: Autobuild
uses: github/codeql-action/autobuild@v1
# ℹ️ Command-line programs to run using the OS shell.
# 📚 https://git.io/JvXDl
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
# and modify them (or add more) to build your code if your project
# uses a compiled language
#- run: |
# make bootstrap
# make release
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v1 |
|
Thank you for sharing. Indeed the problem you're facing is from Since you are interested in running the experimental queries for Go, I suggest you create a query suite file (docs here) that tells CodeQL to look for the experimental folder within the CodeQL bundle already present on Actions. Check this file into your repo:
Then update your CodeQL configuration file to use this query suite:
name: "OPN CodeQL config"
queries:
- uses: security-and-quality
- uses: ./.github/codeql/experimental.qlsYour workflow file does not need to change, since it already uses the |
|
One further suggestion for your workflow file (unrelated to the problem you reported): It is no longer necessary to do the following when running on Instead, it is enough to use: See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-pull-requests for more information. |
|
Thank you so much @adityasharad. I will get back to you once I have time to work on this. Also, let me recap my understanding from your suggestion.
Am I correct? 😅 |
|
Hi @adityasharad, I have a chance to work on this now. The second approach from my comment above is working but from your suggestion is not working with the following error.
What I had done
I tried to look at how to use custom queries in the documentation but still no luck. |
|
Updated. I made it work now Thank you @adityasharad |
|
My mistake, I forgot the leading Glad to help. Please don't hesitate to reopen or file a new issue if you have further questions. |
|
Hi @adityasharad. Faced the same issue but my requirement is a bit different. I've made the three files: codeql.yml, config.yml and custom-queries.qls. Attaching the files for your reference. I want to use security-and-quality and lgtm-full but want to exclude some of the rules/queries that shouldn't be executed while scanning the code. The rules are:
Is it possible to achieve this ? Also let me know if there is an alternative way to achieve this. codeql.yml filecodeql-config.yml filecustom-queries.qls file |
|
@a-z-i-z the use of the config file looks fine, but please try changing your - import: codeql-suites/csharp-security-and-quality.qls
from: codeql-csharp
- exclude:
id:
- cs/dereferenced-value-may-be-null
- cs/virtual-call-in-constructor |
|
@adityasharad Thanks Aditya. This worked well and the mentioned queries were eliminated among all. Thanks again. |
|
@adityasharad I was redirected to this thread from github/codeql#6778 as I am having similar problems with the JPL_C queries from CodeQL. The JPL_C queries can be found here https://github.com/github/codeql/tree/main/cpp/ql/src/JPL_C. I have also tried to change When creating a .qls file, it states that jpl.qls codeql-coding-standard.yml |
|
@ArielSAdamsNASA thanks for asking. Could you please try changing your - queries: JPL_C
from: codeql/cpp-queriesThe name expected in the |
|
@adityasharad Thank you! I reran the workflow again, six days later, and the workflows are no longer failing. I am not sure why the JPL queries from main did not work, but it has been resolved. I will use jpl.qls if this happens again. |
|
Glad to hear it is working. I would generally recommend using a query suite instead of referencing the queries directly from |
|
@adityasharad That makes sense. I will use query suites instead. How would one call an individual query like jsf/4.20 Unions and Bit Fields/AV Rule 153.ql? Does each individual query need to be in a separate .qls file or can they be placed together in the same file? Thanks again! |
Can you tell me a bit more about what you're trying to do? Are you trying to run different queries in different workflows, or a set of specific queries but all in the same workflow? Am I correct in thinking this is still in the context of GitHub Actions? |
|
@adityasharad Yes, this is still in the context of GitHub Actions. I have one workflow that needs all of the JPL queries, but only a selected few of jsf queries. This is what the configuration looks like right now before the query suites. |
adityasharad
changed the title
|
Exactly the information I needed, thank you @ArielSAdamsNASA. # Start with all the queries in the codeql/cpp-queries pack.
- queries: .
from: codeql/cpp-queries
# Restrict to only the queries with the following ID patterns.
- include:
id:
# Regular expression matching all query IDs that start with `cpp/jpl-c/`
# This covers all queries in the `JPL_C` directory,
# but matching on query ID is more stable.
- /cpp/jpl-c/*/
# Specific JSF queries, identified by query ID.
- cpp/jsf/av-rule-153
- cpp/jsf/av-rule-168
- cpp/jsf/av-rule-202
- cpp/jsf/av-rule-165
- cpp/jsf/av-rule-173Each query's ID can be found in the query metadata section at the top of the query file, starting with To help you with future query suite writing:
|
|
Hi Guys, I have monorepo and it contains multiple services written on multiple languages and separated by sub-directory. I want run codeQL analysis on sub-directory level only. And it is working perfectly for JavaScript, TypeScript, Python sub-directories using paths/paths-ignore in codeql-config.yml file as mentioned in GitHub doc. But the same is not working for go language sub-directory. For go lang, it is start scanning all the repository's folders instead of specific go folder. Is there any limitation with go lang? or something different need to be done for go lang? |
Answered in github/codeql#9844. Please don't hesitate to create new issues or discussions for new problems that you encounter. |
Hi CodeQL team,
I found this error occur just about a week ago. I don't change anything in the codebase (because I set this workflow to run on master branch and master branch the last update is a week ago).
Right now this error is raised when my CodeQL run when the schedule time arrive
I still have no idea why does this happens. If you need any additional information, feel free to provide me what you want.
Thank you guys in advance.
The text was updated successfully, but these errors were encountered: