-
Notifications
You must be signed in to change notification settings - Fork 329
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow the codeql-action to run packages #545
Conversation
This commit adds a `packs` option to the codeql-config.yml file. Users can specify a list of ql packs to include in the analysis. For a single language analysis, the packs property looks like this: ```yaml packs: - pack-scope/pack-name1@1.2.3 - pack-scope/pack-name2 # no explicit version means download the latest ``` For multi-language analysis, you must key the packs block by lanaguage: ```yaml packs: cpp: - pack-scope/pack-name1@1.2.3 - pack-scope/pack-name2 java: - pack-scope/pack-name3@1.2.3 - pack-scope/pack-name4 ``` This implementation adds a new analysis run (alongside custom and builtin runs). The unit tests indicate that the correct commands are being run, but I have not actually tried this with a real CLI. Also, convert `instanceof Array` to `Array.isArray` since that is sightly better in some situations. See: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray#instanceof_vs_isarray
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mostly looks good, a few minor comments/questions
Is now a good point to create a feature branch? |
Sure. I'll create one now. |
During the analyze phase.
1c3dec0
to
9b5753a
Compare
Use strings instead. They are easier to serialize and deserialize.
dfde222
to
5135e45
Compare
9985119
to
0aac515
Compare
src/config-utils.ts
Outdated
languages: Language[], | ||
configFile: string | ||
) { | ||
const packs = {} as Packs; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should Packs
be updated such that {}
would be valid? This sort of pattern appears in a few other places in the codebase. It might be that empty objects are intended to be valid for various configuration types (in which case it would make sense to update those types to allow for such shapes to be valid).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I had the type definition wrong. Originally, it was:
export type Packs = Record<Partial<Language>, PackWithVersion[]>;
But it should have been:
export type Packs = Partial<Record<Language, PackWithVersion[]>>;
src/config-utils.ts
Outdated
|
||
// Exported for testing | ||
export function parsePacks( | ||
packsByLanguage: string[] | Record<string, string[]> | undefined, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the use case for packsByLanguage
to be undefined
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This parameter is coming directly from the parsedYAML[PACKS_PROPERTY]
property, parsed from the file. This field is optional and hence possibly undefined.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh, there's a conditional block right above that call site that it should be brought up inside.
codeql-action/src/config-utils.ts
Line 1002 in d42f654
const packs = parsePacks(parsedYAML[PACKS_PROPERTY], languages, configFile); |
0aac515
to
2df7bd0
Compare
2df7bd0
to
d87945e
Compare
1. Better malformed data guard for PackDownloadOutput 2. Fix Packs type 3. Remove TODO in init-action
045cb83
to
f612b8c
Compare
This commit adds a
packs
option to the codeql-config.yml file. Userscan specify a list of ql packs to include in the analysis.
For a single language analysis, the packs property looks like this:
For multi-language analysis, you must key the packs block by lanaguage:
This implementation adds a new analysis run (alongside custom and
builtin runs). The unit tests indicate that the correct commands are
being run, but I have not actually tried this with a real CLI.
Also, convert
instanceof Array
toArray.isArray
since that issightly better in some situations. See:
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray#instanceof_vs_isarray
Merge / deployment checklist