From 48c716c6466d10f853dcfa71db176683e1cf5a4f Mon Sep 17 00:00:00 2001 From: Ben Ahmady <32935794+subatoi@users.noreply.github.com> Date: Fri, 20 Sep 2024 08:12:05 +0100 Subject: [PATCH 1/2] Remove redundant versioning for code scanning (#52352) --- ...g-your-advanced-setup-for-code-scanning.md | 20 +++---------------- .../about-code-scanning-alerts.md | 16 +-------------- ...ode-scanning-alerts-for-your-repository.md | 10 ++-------- .../viewing-code-scanning-logs.md | 4 ---- .../logs-not-detailed-enough.md | 4 ---- .../results-different-than-expected.md | 2 -- ...analyzing-your-code-with-codeql-queries.md | 11 +--------- .../customizing-analysis-with-codeql-packs.md | 14 +++++-------- .../setting-up-the-codeql-cli.md | 3 --- .../about-codeql-workspaces.md | 4 +++- .../advanced-setup-of-the-codeql-cli.md | 3 --- .../creating-and-working-with-codeql-packs.md | 14 +++++-------- .../creating-codeql-query-suites.md | 4 +--- .../publishing-and-using-codeql-packs.md | 9 +++------ .../query-reference-files.md | 2 -- .../testing-custom-queries.md | 4 +++- ...sing-custom-queries-with-the-codeql-cli.md | 4 ---- .../about-multiple-configurations-link.md | 4 ---- 18 files changed, 27 insertions(+), 105 deletions(-) diff --git a/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md b/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md index d6cefefcfa07..5b48150c8c2b 100644 --- a/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md +++ b/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md @@ -296,8 +296,6 @@ In this example, the default queries will be run for Java, as well as the querie {% data reusables.code-scanning.run-additional-queries %} -{% ifversion codeql-packs %} - ### Using query packs To add one or more {% data variables.product.prodname_codeql %} query packs, add a `with: packs:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. Within `packs` you specify one or more packages to use and, optionally, which version to download. Where you don't specify a version, the latest version is downloaded. If you want to use packages that are not publicly available, you need to set the `GITHUB_TOKEN` environment variable to a secret that has access to the packages. For more information, see "[AUTOTITLE](/actions/security-guides/automatic-token-authentication)" and "[AUTOTITLE](/actions/security-guides/encrypted-secrets)." @@ -321,7 +319,6 @@ In the example below, `scope` is the organization or personal account that publi packs: scope/pack1,scope/pack2@1.2.3,scope/pack3@~3.2.1,scope/pack4@4.5.6:path/to/queries ``` -{% ifversion query-pack-compatibility %} {% note %} **Note:** If you specify a particular version of a query pack to use, @@ -334,7 +331,6 @@ To ensure optimal performance, if you need to specify exact query pack versions, For more information about pack compatibility, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs#about-codeql-pack-compatibility)." {% endnote %} -{% endif %} ### Downloading {% data variables.product.prodname_codeql %} packs from {% data variables.product.prodname_ghe_server %} @@ -370,7 +366,6 @@ Notice the `|` after the `registries` property name. This is important since {% ### Using queries in QL packs -{% endif %} To add one or more queries, add a `with: queries:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. If the queries are in a private repository, use the `external-repository-token` parameter to specify a token that has access to checkout the private repository. You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language. @@ -388,24 +383,18 @@ You can also specify query suites in the value of `queries`. Query suites are co {% data reusables.code-scanning.codeql-query-suites-explanation %} -{% ifversion codeql-packs %} - ### Working with custom configuration files -{% endif %} - -If you also use a configuration file for custom settings, any additional {% ifversion codeql-packs %}packs or {% endif %}queries specified in your workflow are used instead of those specified in the configuration file. If you want to run the combined set of additional {% ifversion codeql-packs %}packs or {% endif %}queries, prefix the value of {% ifversion codeql-packs %}`packs` or {% endif %}`queries` in the workflow with the `+` symbol. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)." +If you also use a configuration file for custom settings, any additional packs or queries specified in your workflow are used instead of those specified in the configuration file. If you want to run the combined set of additional packs or queries, prefix the value of `packs` or `queries` in the workflow with the `+` symbol. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)." -In the following example, the `+` symbol ensures that the specified additional {% ifversion codeql-packs %}packs and {% endif %}queries are used together with any specified in the referenced configuration file. +In the following example, the `+` symbol ensures that the specified additional packs and queries are used together with any specified in the referenced configuration file. ``` yaml copy - uses: {% data reusables.actions.action-codeql-action-init %} with: config-file: ./.github/codeql/codeql-config.yml queries: +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main - {%- ifversion codeql-packs %} packs: +scope/pack1,scope/pack2@1.2.3,scope/pack3@4.5.6:path/to/queries - {%- endif %} ``` @@ -415,7 +404,7 @@ In the following example, the `+` symbol ensures that the specified additional { ## Using a custom configuration file -A custom configuration file is an alternative way to specify additional {% ifversion codeql-packs %}packs and {% endif %}queries to run. You can also use the file to disable the default queries{% ifversion code-scanning-exclude-queries-from-analysis %}, exclude or include specific queries,{% endif %} and to specify which directories to scan during analysis. +A custom configuration file is an alternative way to specify additional packs and queries to run. You can also use the file to disable the default queries{% ifversion code-scanning-exclude-queries-from-analysis %}, exclude or include specific queries,{% endif %} and to specify which directories to scan during analysis. In the workflow file, use the `config-file` parameter of the `init` action to specify the path to the configuration file you want to use. This example loads the configuration file _./.github/codeql/codeql-config.yml_. @@ -437,8 +426,6 @@ If the configuration file is located in an external private repository, use the The settings in the configuration file are written in YAML format. -{% ifversion codeql-packs %} - ### Specifying {% data variables.product.prodname_codeql %} query packs You specify {% data variables.product.prodname_codeql %} query packs in an array. Note that the format is different from the format used by the workflow file. @@ -482,7 +469,6 @@ packs: ``` {% endraw %} -{% endif %} {% ifversion codeql-threat-models %} diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md b/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md index 5dd10ba02b11..160c5b5972b4 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md @@ -55,27 +55,13 @@ If you configure {% data variables.product.prodname_code_scanning %} using {% da When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_caps %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users. -### About {% ifversion remove-code-scanning-configurations %}alerts from multiple configurations{% else %}analysis origins{% endif %} +### About alerts from multiple configurations -{% ifversion remove-code-scanning-configurations %} You can run multiple configurations of code analysis on a repository, using different tools and targeting different languages or areas of the code. Each configuration of {% data variables.product.prodname_code_scanning %} generates a unique set of alerts. For example, an alert generated using the default {% data variables.product.prodname_codeql %} analysis with {% data variables.product.prodname_actions %} comes from a different configuration than an alert generated externally and uploaded via the {% data variables.product.prodname_code_scanning %} API. If you use multiple configurations to analyze a file, any problems detected by the same query are reported as alerts generated by multiple configurations. If an alert exists in more than one configuration, the number of configurations appears next to the branch name in the "Affected branches" section on the right-hand side of the alert page. To view the configurations for an alert, in the "Affected branches" section, click a branch. A "Configurations analyzing" modal appears with the names of each configuration generating the alert for that branch. Below each configuration, you can see when that configuration's alert was last updated. An alert may display different statuses from different configurations. To update the alert statuses, re-run each out-of-date configuration. Alternatively, you can delete stale configurations from a branch to remove outdated alerts. For more information on deleting stale configurations and alerts, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch)." -{% else %} -You can run multiple configurations of code analysis on a repository, using different tools and targeting different languages or areas of the code. Each configuration of {% data variables.product.prodname_code_scanning %} is the analysis origin for all the alerts it generates. For example, an alert generated using the default {% data variables.product.prodname_codeql %} analysis with {% data variables.product.prodname_actions %} will have a different analysis origin from an alert generated externally and uploaded via the {% data variables.product.prodname_code_scanning %} API. - -If you use multiple configurations to analyze a file, any problems detected by the same query are reported as alerts with multiple analysis origins. If an alert has more than one analysis origin, a {% octicon "workflow" aria-label="The workflow icon" %} icon will appear next to any relevant branch in the **Affected branches** section on the right-hand side of the alert page. You can hover over the {% octicon "workflow" aria-label="The workflow icon" %} icon to see the names of each analysis origin and the status of the alert for that analysis origin. You can also view the history of when alerts appeared in each analysis origin in the timeline on the alert page. If an alert only has one analysis origin, no information about analysis origins is displayed on the alert page. - -![Screenshot showing a code scanning alert with multiple analysis origins.](/assets/images/help/repository/code-scanning-analysis-origins.png) - -{% note %} - -**Note:** Sometimes a {% data variables.product.prodname_code_scanning %} alert displays as fixed for one analysis origin but is still open for a second analysis origin. You can resolve this by re-running the second {% data variables.product.prodname_code_scanning %} configuration to update the alert status for that analysis origin. - -{% endnote %} -{% endif %} ### About labels for alerts that are not found in application code diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md b/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md index 097805b66655..65991e17af94 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md @@ -166,11 +166,9 @@ Alerts may be fixed in one branch but not in another. You can use the "Branch" f {% note %} **Note:** -{%- ifversion remove-code-scanning-configurations %} + If you run {% data variables.product.prodname_code_scanning %} using multiple configurations, the same alert will sometimes be generated by more than one configuration. Unless you run all configurations regularly, you may see alerts that are fixed in one configuration but not in another. These stale configurations and alerts can be removed from a branch. For more information, see "[Removing stale configurations and alerts from a branch](#removing-stale-configurations-and-alerts-from-a-branch)." -{% else %} -If you run {% data variables.product.prodname_code_scanning %} using multiple configurations, then sometimes an alert will have multiple analysis origins. Unless you run all configurations regularly, you may see alerts that are fixed in one analysis origin but not in another. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-analysis-origins)." -{% endif %} + {% endnote %} ## Dismissing alerts @@ -213,8 +211,6 @@ If a project has multiple alerts that you want to dismiss for the same reason, y If you dismiss an alert but later realize that you need to fix the alert, you can re-open it and fix the problem with the code. Display the list of closed alerts, find the alert, display it, and reopen it. You can then fix the alert in the same way as any other alert. -{% ifversion remove-code-scanning-configurations %} - ## Removing stale configurations and alerts from a branch You may have multiple code scanning configurations on a single repository. When run, multiple configurations can generate the same alert. Additionally, if the configurations are run on different schedules, the alert statuses may become out-of-date for infrequent or stale configurations. For more information on alerts from multiple configurations, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alerts-from-multiple-configurations)." @@ -242,8 +238,6 @@ You may have multiple code scanning configurations on a single repository. When {% endnote %} -{% endif %} - ## Auditing responses to {% data variables.product.prodname_code_scanning %} alerts {% data reusables.code-scanning.audit-code-scanning-events %} diff --git a/content/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs.md b/content/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs.md index fd8cf5e9ce38..ed4e19d75df8 100644 --- a/content/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs.md +++ b/content/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs.md @@ -43,12 +43,8 @@ For information about the {% data variables.product.prodname_codeql_cli %}, see {% data reusables.code-scanning.extractor-diagnostics %} -{% ifversion codeql-action-debug-logging %} - You can see more detailed information about {% data variables.product.prodname_codeql %} extractor errors and warnings that occurred during database creation by enabling debug logging. For more information, see "[AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/logs-are-not-detailed-enough#creating-codeql-debugging-artifacts-by-re-running-jobs-with-debug-logging-enabled)." -{% endif %} - ## Viewing the logging output from {% data variables.product.prodname_code_scanning %} This section applies to {% data variables.product.prodname_code_scanning %} run using {% data variables.product.prodname_actions %} ({% data variables.product.prodname_codeql %} or third-party). diff --git a/content/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough.md b/content/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough.md index 7638393e8719..3e33b62cc479 100644 --- a/content/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough.md +++ b/content/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough.md @@ -24,16 +24,12 @@ The debug artifacts will be uploaded to the workflow run as an artifact named `d These artifacts will help you debug problems with {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}. If you contact GitHub support, they might ask for this data. -{% ifversion codeql-action-debug-logging %} - ### Creating {% data variables.product.prodname_codeql %} debugging artifacts by re-running jobs with debug logging enabled You can create {% data variables.product.prodname_codeql %} debugging artifacts by enabling debug logging and re-running the jobs. For more information about re-running {% data variables.product.prodname_actions %} workflows and jobs, see "[AUTOTITLE](/actions/managing-workflow-runs/re-running-workflows-and-jobs)." You need to ensure that you select **Enable debug logging**. This option enables runner diagnostic logging and step debug logging for the run. You'll then be able to download `debug-artifacts` to investigate further. You do not need to modify the workflow file when creating {% data variables.product.prodname_codeql %} debugging artifacts by re-running jobs. -{% endif %} - ### Creating {% data variables.product.prodname_codeql %} debugging artifacts using a workflow flag You can create {% data variables.product.prodname_codeql %} debugging artifacts by using a flag in your workflow. For this, you need to modify the `init` step of your {% data variables.code-scanning.codeql_workflow %} file and set `debug: true`. diff --git a/content/code-security/code-scanning/troubleshooting-code-scanning/results-different-than-expected.md b/content/code-security/code-scanning/troubleshooting-code-scanning/results-different-than-expected.md index 8d4ecf0cc227..374dd58f7d9d 100644 --- a/content/code-security/code-scanning/troubleshooting-code-scanning/results-different-than-expected.md +++ b/content/code-security/code-scanning/troubleshooting-code-scanning/results-different-than-expected.md @@ -17,6 +17,4 @@ To check if default setup is enabled, navigate to the main page of the repositor If you want to return to using advanced setup and get {% data variables.product.prodname_code_scanning %} results from your custom workflow file, click {% octicon "stop" aria-hidden="true" %} **Disable {% data variables.product.prodname_codeql %}** to disable default setup. Then you should re-enable your pre-existing workflows to start triggering and uploading results from advanced setup. For more information, see "[AUTOTITLE](/actions/managing-workflow-runs/disabling-and-enabling-a-workflow)" and "[AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning)." -{% ifversion remove-code-scanning-configurations %} {% data reusables.code-scanning.troubleshooting-multiple-configurations %} -{% endif %} diff --git a/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries.md b/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries.md index 2800f6ec9545..bd27178e262b 100644 --- a/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries.md +++ b/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries.md @@ -54,7 +54,7 @@ codeql database analyze --format= --output= --format= \ --sarif-category= --output= \ - {% ifversion codeql-packs %}{% else %}{% endif %} + ``` {% endnote %} @@ -70,10 +70,8 @@ You must specify ``, `--format`, and `--output`. You can specify addit | --sarif-category | {% octicon "question" aria-label="Required with multiple results sets" %} | Optional for single database analysis. Required to define the language when you analyze multiple databases for a single commit in a repository.

Specify a category to include in the SARIF results file for this analysis. A category is used to distinguish multiple analyses for the same tool and commit, but performed on different languages or different parts of the code. | | --sarif-add-baseline-file-info | {% octicon "x" aria-label="Optional" %} | **Recommended.** Use to submit file coverage information to the {% data variables.code-scanning.tool_status_page %}. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/about-the-tool-status-page#how-codeql-defines-scanned-files)." | | --sarif-include-query-help | {% octicon "x" aria-label="Optional" %} | Specify whether to include query help in the SARIF output. One of: `always`: Include query help for all queries. `custom_queries_only` (default): Include query help only for custom queries, that is, queries in query packs which are not of the form `codeql/-queries`. `never`: Do not include query help for any queries. Any query help for custom queries included in the SARIF output will be displayed in any code scanning alerts for the query. For more information, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/using-custom-queries-with-the-codeql-cli#including-query-help-for-custom-codeql-queries-in-sarif-files)." | -| {% ifversion codeql-packs %} | | `` | {% octicon "x" aria-label="Optional" %} | Use if you want to include {% data variables.product.prodname_codeql %} query packs in your analysis. For more information, see "[Downloading and using {% data variables.product.prodname_codeql %} packs](/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs#downloading-and-using-codeql-query-packs)." | | --download | {% octicon "x" aria-label="Optional" %} | Use if some of your {% data variables.product.prodname_codeql %} query packs are not yet on disk and need to be downloaded before running queries. | -| {% endif %} | | --threads | {% octicon "x" aria-label="Optional" %} | Use if you want to use more than one thread to run queries. The default value is `1`. You can specify more threads to speed up query execution. To set the number of threads to the number of logical processors, specify `0`. | | --verbose | {% octicon "x" aria-label="Optional" %} | Use to get more detailed information about the analysis process and diagnostic data from the database creation process. | | --threat-model | {% octicon "x" aria-label="Optional" %} | (Beta) Use to add threat models to configure additional sources in your {% data variables.product.prodname_codeql %} analysis. During the beta, threat models are supported only by Java analysis. For more information, see "[AUTOTITLE](/code-security/codeql-cli/codeql-cli-manual/database-analyze#--threat-modelname)." | @@ -126,8 +124,6 @@ $ codeql database analyze /codeql-dbs/example-repo \ The following examples show how to run `database analyze` using {% data variables.product.prodname_codeql %} packs, and how to use a local checkout of the {% data variables.product.prodname_codeql %} repository. These examples assume your {% data variables.product.prodname_codeql %} databases have been created in a directory that is a sibling of your local copies of the {% data variables.product.prodname_codeql %} repository. -{% ifversion codeql-packs %} - ### Running a {% data variables.product.prodname_codeql %} query pack To run an existing {% data variables.product.prodname_codeql %} query pack from the {% data variables.product.prodname_dotcom %} {% data variables.product.prodname_container_registry %}, you can specify one or more pack names: @@ -139,7 +135,6 @@ codeql database analyze microsoft/coding-standards@1.0.0 github/secur This command runs the default query suite of two {% data variables.product.prodname_codeql %} query packs: `microsoft/coding-standards` version 1.0.0 and the latest version of `github/security-queries` on the specified database. For further information about default suites, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs)." The `--download` flag is optional. Using it will ensure the query pack is downloaded if it isn’t yet available locally. -{% endif %} ### Running a single query @@ -203,8 +198,6 @@ When the analysis has finished, a SARIF results file is generated. Specifying `- that the results are formatted according to the most recent SARIF specification supported by {% data variables.product.prodname_codeql %}. -{% ifversion codeql-packs %} - ### Running a subset of queries in a {% data variables.product.prodname_codeql %} pack If you are using {% data variables.product.prodname_codeql_cli %} v2.8.1 or later, you can include a path at the end of a pack specification to run a subset of queries inside the pack. This applies to any command that locates or runs queries within a pack. @@ -262,8 +255,6 @@ codeql database analyze --format=sarif-latest --output=results \ For more information about {% data variables.product.prodname_codeql %} packs, see [AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs). -{% endif %} - ### Running query suites To run a query suite on a {% data variables.product.prodname_codeql %} database for a C/C++ codebase, diff --git a/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs.md b/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs.md index 7e023b4a7e65..00800d708a6e 100644 --- a/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs.md +++ b/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs.md @@ -4,7 +4,9 @@ intro: 'You can use {% data variables.product.prodname_codeql %} packs to run {% shortTitle: Customizing analysis product: '{% data reusables.gated-features.codeql %}' versions: - feature: codeql-packs + fpt: '*' + ghes: '*' + ghec: '*' topics: - Advanced Security - Code scanning @@ -22,9 +24,9 @@ redirect_from: There are{% ifversion codeql-model-packs %} three{% else %} two{% endif %} types of {% data variables.product.prodname_codeql %} packs: {% ifversion codeql-model-packs %}query packs, library packs, and model packs{% else %} query packs and library packs{% endif %}. -* Query packs contain a set of pre-compiled queries that can be evaluated on a {% data variables.product.prodname_codeql %} database. Query packs are designed to be run. When a query pack is published, the bundle includes all the transitive dependencies and {% ifversion query-pack-compatibility %}pre-compiled representations of each query, in addition to the query sources{% else %}a compilation cache{% endif %}. This ensures consistent and efficient execution of the queries in the pack. +* Query packs contain a set of pre-compiled queries that can be evaluated on a {% data variables.product.prodname_codeql %} database. Query packs are designed to be run. When a query pack is published, the bundle includes all the transitive dependencies and pre-compiled representations of each query, in addition to the query sources. This ensures consistent and efficient execution of the queries in the pack. -* Library packs are designed to be used by query packs (or other library packs) and do not contain queries themselves. The libraries are not compiled {% ifversion query-pack-compatibility %}separately{% else %}and there is no compilation cache included when the pack is published{% endif %}.{% ifversion codeql-model-packs %} +* Library packs are designed to be used by query packs (or other library packs) and do not contain queries themselves. The libraries are not compiled separately.{% ifversion codeql-model-packs %} * Model packs can be used to expand {% data variables.product.prodname_code_scanning %} analysis to recognize libraries and frameworks that are not supported by default. Model packs are currently in beta and subject to change. During the beta, model packs are available for {% data variables.code-scanning.codeql_model_packs_support %} analysis. For more information about creating your own model packs, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack)." @@ -56,7 +58,6 @@ Before you can use a {% data variables.product.prodname_codeql %} query pack to | | {% octicon "check" aria-label="Required" %} | Specify the scope and name of one or more {% data variables.product.prodname_codeql %} query packs to download using a comma-separated list. Optionally, include the version to download and unzip. By default the latest version of this pack is downloaded. Optionally, include a path to a query, directory, or query suite to run. If no path is included, then run the default queries of this pack. | | --github-auth-stdin | {% octicon "x" aria-label="Optional" %} | Pass the CLI the {% data variables.product.prodname_github_app %} or {% data variables.product.pat_generic %} created for authentication with {% data variables.product.company_short %}'s REST API from your secret store via standard input. This is not needed if the command has access to a `GITHUB_TOKEN` environment variable set with this token. -{% ifversion query-pack-compatibility %} {% note %} **Note:** If you specify a particular version of a query pack to use, be aware that the version you specify may eventually become too old for the latest version of {% data variables.product.prodname_codeql %} to make efficient use of. To ensure optimal performance, if you need to specify exact query pack versions, you should reevaluate which versions you pin to whenever you upgrade the {% data variables.product.prodname_codeql_cli %} you're using. @@ -64,7 +65,6 @@ Before you can use a {% data variables.product.prodname_codeql %} query pack to For more information about pack compatibility, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs#about-codeql-pack-compatibility)." {% endnote %} -{% endif %} ### Basic example of downloading and using query packs @@ -184,8 +184,6 @@ For more information about writing your own model packs, see "[AUTOTITLE](/code- {% endif %} -{% ifversion query-pack-compatibility %} - ### About published packs When a pack is published for use in analyses, the `codeql pack create` or `codeql pack publish` command verifies that the content is complete and also adds some additional pieces of content to it: @@ -195,5 +193,3 @@ When a pack is published for use in analyses, the `codeql pack create` or `codeq * For query packs, precompiled representations of each of the queries. These are faster to execute than it would be to compile the QL source for the query at each analysis. Most of this data is located in a directory named `.codeql` in the published pack, but precompiled queries are in files with a `.qlx` suffix next to the `.ql` source for each query. When analyzing a database with a query from a published pack, {% data variables.product.prodname_codeql %} will load these files instead of the `.ql` source. If you need to modify the content of a _published_ pack, be sure to remove all of the `.qlx` files, since they may prevent modifications in the `.ql` files from taking effect. - -{% endif %} diff --git a/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/setting-up-the-codeql-cli.md b/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/setting-up-the-codeql-cli.md index 408f311e6e25..c95802d62d89 100644 --- a/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/setting-up-the-codeql-cli.md +++ b/content/code-security/codeql-cli/getting-started-with-the-codeql-cli/setting-up-the-codeql-cli.md @@ -95,11 +95,8 @@ You should check that the output contains the expected languages and also that t You can also run `codeql resolve languages` to show which languages are available for database creation. This will list the languages supported by default in your {% data variables.product.prodname_codeql_cli %} package. -{% ifversion codeql-packs %} Optionally, you can download some CodeQL packs containing pre-compiled queries you would like to run. For more information, see "[AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs)." -{% endif %} - ## Next steps To learn how to prepare your code to be analyzed by the {% data variables.product.prodname_codeql_cli %}, see "[AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/preparing-your-code-for-codeql-analysis)." diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/about-codeql-workspaces.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/about-codeql-workspaces.md index e719bfd4f124..071412c24aed 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/about-codeql-workspaces.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/about-codeql-workspaces.md @@ -3,7 +3,9 @@ title: About CodeQL workspaces intro: '{% data variables.product.prodname_codeql %} workspaces allow you to develop and maintain a group of {% data variables.product.prodname_codeql %} packs that depend on each other.' product: '{% data reusables.gated-features.codeql %}' versions: - feature: codeql-packs + fpt: '*' + ghes: '*' + ghec: '*' topics: - Advanced Security - Code scanning diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/advanced-setup-of-the-codeql-cli.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/advanced-setup-of-the-codeql-cli.md index 4da358f47910..8f7815dd9e11 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/advanced-setup-of-the-codeql-cli.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/advanced-setup-of-the-codeql-cli.md @@ -52,13 +52,10 @@ Rename this folder `codeql-repo` to avoid conflicting with the {% data variables clone and rename the repository in a single step by running `git clone git@github.com:github/codeql.git codeql-repo` in the `codeql-home` folder. -{% ifversion codeql-packs %} - Within this repository, the queries and libraries are organized into {% data variables.product.prodname_codeql %} packs. Along with the queries themselves, {% data variables.product.prodname_codeql %} packs contain important metadata that tells the {% data variables.product.prodname_codeql_cli %} how to process the query files. For more information, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs)." -{% endif %} {% note %} diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs.md index bfbb0a2c70fc..fbeb6d301403 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs.md @@ -3,7 +3,9 @@ title: Creating and working with CodeQL packs intro: 'You can use {% data variables.product.prodname_codeql %} packs to create, share, depend on, and run {% data variables.product.prodname_codeql %} queries and libraries.' product: '{% data reusables.gated-features.codeql %}' versions: - feature: codeql-packs + fpt: '*' + ghes: '*' + ghec: '*' topics: - Advanced Security - Code scanning @@ -21,17 +23,15 @@ redirect_from: There are{% ifversion codeql-model-packs %} three{% else %} two{% endif %} types of {% data variables.product.prodname_codeql %} packs: {% ifversion codeql-model-packs %}query packs, library packs, and model packs{% else %} query packs and library packs{% endif %}. -* Query packs are designed to be run. When a query pack is published, the bundle includes all the transitive dependencies and {% ifversion query-pack-compatibility %}pre-compiled representations of each query, in addition to the query sources{% else %}a compilation cache{% endif %}. This ensures consistent and efficient execution of the queries in the pack. +* Query packs are designed to be run. When a query pack is published, the bundle includes all the transitive dependencies and pre-compiled representations of each query, in addition to the query sources. This ensures consistent and efficient execution of the queries in the pack. -* Library packs are designed to be used by query packs (or other library packs) and do not contain queries themselves. The libraries are not compiled {% ifversion query-pack-compatibility %}separately{% else %}and there is no compilation cache included when the pack is published{% endif %}.{% ifversion codeql-model-packs %} +* Library packs are designed to be used by query packs (or other library packs) and do not contain queries themselves. The libraries are not compiled separately.{% ifversion codeql-model-packs %} * Model packs can be used to expand {% data variables.product.prodname_code_scanning %} analysis to include dependencies that are not supported by default. Model packs are currently in beta and subject to change. During the beta, model packs are available for {% data variables.code-scanning.codeql_model_packs_support %} analysis. For more information about creating your own model packs, see "[Creating a {% data variables.product.prodname_codeql %} model pack](#creating-a-codeql-model-pack)."{% endif %} You can use the `pack` command in the {% data variables.product.prodname_codeql_cli %} to create {% data variables.product.prodname_codeql %} packs, add dependencies to packs, and install or update dependencies. You can also publish and download {% data variables.product.prodname_codeql %} packs using the `pack` command. For more information, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs)." -{% ifversion query-pack-compatibility %} For more information about compatibility between published query packs and different {% data variables.product.prodname_codeql %} releases, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs#about-codeql-pack-compatibility)." -{% endif %} The standard {% data variables.product.prodname_codeql %} packages for all supported languages are published in the [{% data variables.product.prodname_container_registry %}](https://github.com/orgs/codeql/packages). The [{% data variables.product.prodname_codeql %} repository](https://github.com/github/codeql) contains source files for the standard {% data variables.product.prodname_codeql %} packs for all supported languages. The core query packs, which are included in the {% data variables.product.prodname_codeql %} CLI bundle, but you can otherwise download, are: @@ -139,8 +139,6 @@ This command downloads all dependencies to the shared cache on the local disk. {% endnote %} -{% ifversion query-pack-compatibility %} - ## Customizing a downloaded {% data variables.product.prodname_codeql %} pack The recommended way to experiment with changes to a pack is to clone the repository containing its source code. @@ -150,5 +148,3 @@ If no source repository is available and you need to base modifications on a pac * Change the pack _name_ in `qlpack.yml` so you avoid confusion with results from the unmodified pack. * Remove all files named `*.qlx` anywhere in the unpacked directory structure. These files contain precompiled versions of the queries, and in some situations {% data variables.product.prodname_codeql %} will use them in preference to the QL source you have modified. - -{% endif %} diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-codeql-query-suites.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-codeql-query-suites.md index 1116aec2ac6c..bd08c63abd90 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-codeql-query-suites.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-codeql-query-suites.md @@ -20,7 +20,7 @@ redirect_from: {% data reusables.code-scanning.codeql-cli-version-ghes %} {% data variables.product.prodname_codeql %} query suites provide a way of selecting queries, based on their -filename, location on disk{% ifversion codeql-packs %} or in a {% data variables.product.prodname_codeql %} pack{% endif %}, or metadata properties. +filename, location on disk or in a {% data variables.product.prodname_codeql %} pack, or metadata properties. Create query suites for the queries that you want to frequently use in your {% data variables.product.prodname_codeql %} analyses. @@ -29,13 +29,11 @@ mapping with (usually) a single key. The instructions are executed in the order they appear in the query suite definition. After all the instructions in the suite definition have been executed, the result is a set of selected queries. -{% ifversion codeql-packs %} {% note %} **Note:** Any custom queries that you want to add to a query suite must be in a "[{% data variables.product.prodname_codeql %} pack](/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs)" and contain the correct query metadata. For more information, see "[Using custom queries with the {% data variables.product.prodname_codeql_cli %}](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/using-custom-queries-with-the-codeql-cli)." {% endnote %} -{% endif %} ## Locating queries to add to a query suite diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs.md index f0b8caf6e7de..0e309432fa08 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs.md @@ -3,7 +3,9 @@ title: Publishing and using CodeQL packs intro: 'You can publish your own {% data variables.product.prodname_codeql %} packs and use packs published by other people.' product: '{% data reusables.gated-features.codeql %}' versions: - feature: codeql-packs + fpt: '*' + ghes: '*' + ghec: '*' topics: - Advanced Security - Code scanning @@ -65,7 +67,6 @@ codeql pack download /@x.x.x This command accepts arguments for multiple packs. -{% ifversion query-pack-compatibility %} If you write scripts that specify a particular version number of a query pack to download, keep in mind that when you update your version of {% data variables.product.prodname_codeql %} to a newer one, you may @@ -74,7 +75,6 @@ versions of {% data variables.product.prodname_codeql %} _may_ provide degraded performance when used with query packs that have been pinned to a very old version. For more information, see "[About {% data variables.product.prodname_codeql %} pack compatibility](#about-codeql-pack-compatibility)." -{% endif %} ## Using a {% data variables.product.prodname_codeql %} pack to analyze a {% data variables.product.prodname_codeql %} database @@ -96,7 +96,6 @@ The `analyze` command will run the default suite of any specified {% data variab codeql analyze / / ``` -{% ifversion query-pack-compatibility %} {% note %} **Note:** The `codeql pack download` command stores the pack it downloads in an internal location that is not intended for local modification. Unexpected (and hard to troubleshoot) behavior may result if the pack is modified after downloading. For more information about customizing packs, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs)." @@ -131,8 +130,6 @@ If you publish query packs on the {% data variables.product.prodname_container_r If you publish query packs with the intention of using them on a {% data variables.product.prodname_ghe_server %} installation that uses its bundled {% data variables.product.prodname_codeql %} binaries, use the same {% data variables.product.prodname_codeql %} version to run `codeql pack publish`. Newer versions might produce pre-compiled queries that the one in {% data variables.product.prodname_ghe_server %} may not recognize. Your {% data variables.product.prodname_ghe_server %} administrator may choose to upgrade to a newer version of {% data variables.product.prodname_codeql %} periodically. If so, follow their lead. -{% endif %} - {% ifversion ghes %} ## Working with {% data variables.product.prodname_codeql %} packs on {% data variables.product.prodname_ghe_server %} diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/query-reference-files.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/query-reference-files.md index 1602ba876e63..b16ada3d58a3 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/query-reference-files.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/query-reference-files.md @@ -58,6 +58,4 @@ to the `codeql/javascript-queries` {% data variables.product.prodname_codeql %} AngularJS/DeadAngularJSEventListener.ql ``` -{% ifversion codeql-packs %} For another example, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/testing-custom-queries)." -{% endif %} diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/testing-custom-queries.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/testing-custom-queries.md index d2236471ce35..7fdf7e405260 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/testing-custom-queries.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/testing-custom-queries.md @@ -3,7 +3,9 @@ title: Testing custom queries intro: 'You can set up tests for your {% data variables.product.prodname_codeql %} queries to ensure that they continue to return the expected results with new releases of the {% data variables.product.prodname_codeql_cli %}.' product: '{% data reusables.gated-features.codeql %}' versions: - feature: codeql-packs + fpt: '*' + ghes: '*' + ghec: '*' topics: - Advanced Security - Code scanning diff --git a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/using-custom-queries-with-the-codeql-cli.md b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/using-custom-queries-with-the-codeql-cli.md index 65ff4688cf14..19eb92c9be38 100644 --- a/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/using-custom-queries-with-the-codeql-cli.md +++ b/content/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/using-custom-queries-with-the-codeql-cli.md @@ -49,8 +49,6 @@ For more information about these metadata properties, see "[Metadata for {% data {% endnote %} -{% ifversion codeql-packs %} - ## Packaging custom QL queries When you write your own queries with the intention to share them with others, you should save them in a custom {% data variables.product.prodname_codeql %} pack. You can publish the pack as a {% data variables.product.prodname_codeql %} pack to {% data variables.product.prodname_registry %} - the {% data variables.product.prodname_dotcom %} {% data variables.product.prodname_container_registry %}. For more information, see "[AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs)." @@ -61,8 +59,6 @@ When you write your own queries with the intention to share them with others, yo For each {% data variables.product.prodname_codeql %} pack, the `qlpack.yml` file includes information that tells the {% data variables.product.prodname_codeql_cli %} how to compile the queries, which other {% data variables.product.prodname_codeql %} packs and libraries the pack depends on, and where to find query suite definitions. For more information about what to include in this file, see "[AUTOTITLE](/code-security/codeql-cli/getting-started-with-the-codeql-cli/customizing-analysis-with-codeql-packs#codeqlpack-yml-properties)." -{% endif %} - ## Including query help for custom {% data variables.product.prodname_codeql %} queries in SARIF files If you use the {% data variables.product.prodname_codeql_cli %} to run code scanning analyses on third party CI/CD systems, diff --git a/data/reusables/code-scanning/about-multiple-configurations-link.md b/data/reusables/code-scanning/about-multiple-configurations-link.md index 05231d2ba425..df0c78653097 100644 --- a/data/reusables/code-scanning/about-multiple-configurations-link.md +++ b/data/reusables/code-scanning/about-multiple-configurations-link.md @@ -1,5 +1 @@ -{% ifversion remove-code-scanning-configurations %} If you run code scanning using multiple configurations, the same alert will sometimes be generated by more than one configuration. If an alert comes from multiple configurations, you can view the status of the alert for each configuration on the alert page. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alerts-from-multiple-configurations)." -{% else %} -If you run code scanning using multiple configurations, an alert will sometimes have multiple analysis origins. If an alert has multiple analysis origins, you can view the status of the alert for each analysis origin on the alert page. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-analysis-origins)." -{% endif %} From 6e0c543d8b719fb32187cfd6d74a39b28d13d613 Mon Sep 17 00:00:00 2001 From: Felicity Chapman Date: Fri, 20 Sep 2024 09:48:37 +0100 Subject: [PATCH 2/2] Remove redundant versioning from articles part 3: Code scanning (#52350) Co-authored-by: Vanessa --- ...g-your-advanced-setup-for-code-scanning.md | 9 +-------- ...ode-scanning-alerts-for-your-repository.md | 9 ++------- ...g-code-scanning-alerts-in-pull-requests.md | 20 ++++--------------- .../choose-alert-dismissal-reason.md | 3 +-- .../example-configuration-files.md | 8 ++------ .../code-scanning/run-additional-queries.md | 2 -- 6 files changed, 10 insertions(+), 41 deletions(-) diff --git a/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md b/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md index 5b48150c8c2b..70f6996af2bc 100644 --- a/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md +++ b/content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md @@ -404,7 +404,7 @@ In the following example, the `+` symbol ensures that the specified additional p ## Using a custom configuration file -A custom configuration file is an alternative way to specify additional packs and queries to run. You can also use the file to disable the default queries{% ifversion code-scanning-exclude-queries-from-analysis %}, exclude or include specific queries,{% endif %} and to specify which directories to scan during analysis. +A custom configuration file is an alternative way to specify additional packs and queries to run. You can also use the file to disable the default queries, exclude or include specific queries, and to specify which directories to scan during analysis. In the workflow file, use the `config-file` parameter of the `init` action to specify the path to the configuration file you want to use. This example loads the configuration file _./.github/codeql/codeql-config.yml_. @@ -497,8 +497,6 @@ Optionally, you can give each array element a name, as shown in the example conf If you only want to run custom queries, you can disable the default security queries by using `disable-default-queries: true`. -{% ifversion code-scanning-exclude-queries-from-analysis %} - ### Excluding specific queries from analysis You can add `exclude` and `include` filters to your custom configuration file, to specify the queries you want to exclude or include in the analysis. @@ -532,8 +530,6 @@ You can find another example illustrating the use of these filters in the "[Exam For more information about using `exclude` and `include` filters in your custom configuration file, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-codeql-query-suites#filtering-the-queries-in-a-query-suite)." For information on the query metadata you can filter on, see "[Metadata for CodeQL queries](https://codeql.github.com/docs/writing-codeql-queries/metadata-for-codeql-queries/)." -{% endif %} - ### Specifying directories to scan When codebases are analyzed without building the code, you can restrict {% data variables.product.prodname_code_scanning %} to files in specific directories by adding a `paths` array to the configuration file. You can also exclude the files in specific directories from analysis by adding a `paths-ignore` array. You can use this option when you run the {% data variables.product.prodname_codeql %} actions on an interpreted language (Python, Ruby, and JavaScript/TypeScript){% ifversion codeql-no-build %} or when you analyze a compiled language without building the code (currently supported for {% data variables.code-scanning.no_build_support %}){% endif %}. @@ -564,8 +560,6 @@ You can quickly analyze small portions of a monorepo when you modify code in spe {% data reusables.code-scanning.example-configuration-files %} -{% ifversion code-scanning-config-input %} - ## Specifying configuration details using the `config` input If you'd prefer to specify additional configuration details in the workflow file, you can use the `config` input of the `init` command of the {% data variables.product.prodname_codeql %} action. The value of this input must be a YAML string that follows the configuration file format documented at "[Using a custom configuration file](#using-a-custom-configuration-file)" above. @@ -605,7 +599,6 @@ In the following example, `vars.CODEQL_CONF` is a {% data variables.product.prod ``` {% endtip %} -{% endif %} ## Configuring {% data variables.product.prodname_code_scanning %} for compiled languages diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md b/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md index 65991e17af94..0cfd17a1addc 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md @@ -182,8 +182,8 @@ When you dismiss an alert: * It's dismissed in all branches. * The alert is removed from the number of current alerts for your project. * The alert is moved to the "Closed" list in the summary of alerts, from where you can reopen it, if required. -* The reason why you closed the alert is recorded.{% ifversion comment-dismissed-code-scanning-alert %} -* Optionally, you can comment on a dismissal to record the context of an alert dismissal.{% endif %} +* The reason why you closed the alert is recorded. +* Optionally, you can comment on a dismissal to record the context of an alert dismissal. * Next time {% data variables.product.prodname_code_scanning %} runs, the same code won't generate an alert. To dismiss alerts: @@ -192,13 +192,8 @@ To dismiss alerts: {% data reusables.repositories.sidebar-security %} {% data reusables.repositories.sidebar-code-scanning-alerts %} 1. If you want to dismiss an alert, it's important to explore the alert first, so that you can choose the correct dismissal reason. Click the alert you'd like to explore. -{%- ifversion comment-dismissed-code-scanning-alert %} 1. Review the alert, then click **Dismiss alert** and choose, or type, a reason for closing the alert. ![Screenshot of the check failure for a {% data variables.product.prodname_code_scanning %} alert in a pull request. The "Dismiss alert" button in the check failure is highlighted in dark orange. The "Dismiss alert" drop-down is displayed. ](/assets/images/help/repository/code-scanning-alert-dropdown-reason.png) -{%- else %} -1. Review the alert, then click **Dismiss** and choose a reason for closing the alert. - ![Choosing a reason for dismissing an alert.](/assets/images/help/repository/code-scanning-alert-close-drop-down.png) -{%- endif %} {% data reusables.code-scanning.choose-alert-dismissal-reason %} {% data reusables.code-scanning.false-positive-fix-codeql %} diff --git a/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md b/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md index 2677428b04b4..284295fce06d 100644 --- a/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md +++ b/content/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests.md @@ -30,8 +30,8 @@ In repositories where {% data variables.product.prodname_code_scanning %} is con If the lines of code changed in the pull request generate {% data variables.product.prodname_code_scanning %} alerts, the alerts are reported in the following places on the pull request. -* Check results in the pull request {% ifversion code-scanning-pr-conversations-tab %} -* The **Conversation** tab of the pull request, as part of a pull request review {% endif %} +* Check results in the pull request +* The **Conversation** tab of the pull request, as part of a pull request review * The **Files changed** tab of the pull request {% note %} @@ -88,19 +88,12 @@ As with other pull request checks, you can see full details of the check failure ## Viewing an alert on your pull request -{% ifversion code-scanning-pr-conversations-tab %} You can see any {% data variables.product.prodname_code_scanning %} alerts that are inside the diff of the changes introduced in a pull request by viewing the **Conversation** tab. {% data variables.product.prodname_code_scanning_caps %} posts a pull request review that shows each alert as an annotation on the lines of code that triggered the alert. You can comment on the alerts, dismiss the alerts, and view paths for the alerts, directly from the annotations. You can view the full details of an alert by clicking the "Show more details" link, which will take you to the alert details page. ![Screenshot of an alert annotation on the "Conversations" tab of a pull request. The "Show more details" link is outlined in dark orange.](/assets/images/help/repository/code-scanning-pr-conversation-tab.png) You can also view all {% data variables.product.prodname_code_scanning %} alerts that are inside the diff of the changes introduced in the pull request in the **Files changed** tab. -{% else %} -You can see any {% data variables.product.prodname_code_scanning %} alerts introduced in a pull request by displaying the **Files changed** tab. Each alert is shown as an annotation on the lines of code that triggered the alert. The severity of the alert is displayed in the annotation. - -![Screenshot showing an alert annotation within a pull request diff.](/assets/images/help/repository/code-scanning-pr-annotation.png) -{% endif %} - If you add a new code scanning configuration in your pull request, you will see a comment on your pull request directing you to the **Security** tab of the repository so you can view all the alerts on the pull request branch. For more information about viewing the alerts for a repository, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository)." If you have write permission for the repository, some annotations contain links with extra context for the alert. In the example above, from {% data variables.product.prodname_codeql %} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can also view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {% data variables.product.prodname_codeql %}, see "[About data flow analysis](https://codeql.github.com/docs/writing-codeql-queries/about-data-flow-analysis/)." @@ -113,14 +106,11 @@ In the detailed view for an alert, some {% data variables.product.prodname_code_ ![Screenshot showing the description for a {% data variables.product.prodname_code_scanning %} alert. A link labeled "Show more" is highlighted with a dark orange outline.](/assets/images/help/repository/code-scanning-pr-alert.png) -{% ifversion code-scanning-pr-conversations-tab %} - ## Commenting on an alert in a pull request You can comment on any {% data variables.product.prodname_code_scanning %} alert that appears in a pull request. Alerts appear as annotations in the **Conversation** tab of a pull request, as part of a pull request review, and also are shown in the **Files changed** tab. You can choose to require all conversations in a pull request, including those on {% data variables.product.prodname_code_scanning %} alerts, to be resolved before a pull request can be merged. For more information, see "[AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-conversation-resolution-before-merging)." -{% endif %} ## Fixing an alert on your pull request @@ -176,11 +166,9 @@ If you decide to reject a {% data variables.product.prodname_copilot_autofix_sho ## Dismissing an alert on your pull request An alternative way of closing an alert is to dismiss it. You can dismiss an alert if you don't think it needs to be fixed. {% data reusables.code-scanning.close-alert-examples %} If you have write permission for the repository, a **Dismiss alert** button is available in code annotations and in the alerts summary. When you click **Dismiss alert** you will be prompted to choose a reason for closing the alert. -{% ifversion comment-dismissed-code-scanning-alert %} + ![Screenshot of a check failure for code scanning. The "Dismiss alert" button is highlighted in dark orange. The "Dismiss alert" drop-down is shown.](/assets/images/help/repository/code-scanning-alert-dropdown-reason.png) -{% else %} -![Choosing a reason for dismissing an alert.](/assets/images/help/repository/code-scanning-alert-close-drop-down.png) -{% endif %} + {% data reusables.code-scanning.choose-alert-dismissal-reason %} {% data reusables.code-scanning.false-positive-fix-codeql %} diff --git a/data/reusables/code-scanning/choose-alert-dismissal-reason.md b/data/reusables/code-scanning/choose-alert-dismissal-reason.md index ca36d76aba83..2ef1bc3c7e1a 100644 --- a/data/reusables/code-scanning/choose-alert-dismissal-reason.md +++ b/data/reusables/code-scanning/choose-alert-dismissal-reason.md @@ -1,2 +1 @@ -It's important to choose the appropriate reason from the drop-down menu as this may affect whether a query continues to be included in future analysis. {% ifversion comment-dismissed-code-scanning-alert %}Optionally, you can comment on a dismissal to record the context of an alert dismissal. The dismissal comment is added to the alert timeline and can be used as justification during auditing and reporting. You can retrieve or set a comment by using the code scanning REST API. The comment is contained in `dismissed_comment` for the `alerts/{alert_number}` endpoint. For more information, see "[AUTOTITLE](/rest/code-scanning#update-a-code-scanning-alert)." -{% endif %} +It's important to choose the appropriate reason from the drop-down menu as this may affect whether a query continues to be included in future analysis. Optionally, you can comment on a dismissal to record the context of an alert dismissal. The dismissal comment is added to the alert timeline and can be used as justification during auditing and reporting. You can retrieve or set a comment by using the code scanning REST API. The comment is contained in `dismissed_comment` for the `alerts/{alert_number}` endpoint. For more information, see "[AUTOTITLE](/rest/code-scanning#update-a-code-scanning-alert)." diff --git a/data/reusables/code-scanning/example-configuration-files.md b/data/reusables/code-scanning/example-configuration-files.md index 2a41459c6f14..5330b43debec 100644 --- a/data/reusables/code-scanning/example-configuration-files.md +++ b/data/reusables/code-scanning/example-configuration-files.md @@ -25,14 +25,12 @@ queries: uses: ./codeql-packs/complex-python-codeql-pack/rootAndBar.qls paths: - - src -paths-ignore: + - src +paths-ignore: - src/node_modules - '**/*.test.js' ``` -{% ifversion code-scanning-exclude-queries-from-analysis %} - The following configuration file only runs queries that generate alerts of severity error. The configuration first selects all the default queries, all queries in `./my-queries`, and the default suite in `codeql/java-queries`, then excludes all the queries that generate warnings or recommendations. ``` yaml @@ -47,5 +45,3 @@ query-filters: - warning - recommendation ``` - -{% endif %} diff --git a/data/reusables/code-scanning/run-additional-queries.md b/data/reusables/code-scanning/run-additional-queries.md index 9263145d58fb..bcbedb95d6e0 100644 --- a/data/reusables/code-scanning/run-additional-queries.md +++ b/data/reusables/code-scanning/run-additional-queries.md @@ -1,12 +1,10 @@ When you use {% data variables.product.prodname_codeql %} to scan code, the {% data variables.product.prodname_codeql %} analysis engine generates a database from the code and runs queries on it. {% data variables.product.prodname_codeql %} analysis uses a default set of queries, but you can specify more queries to run, in addition to the default queries. -{% ifversion code-scanning-exclude-queries-from-analysis %} {% tip %} You can also specify the queries you want to exclude from analysis, or include in the analysis. This requires the use of a custom configuration file. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)" and "[Excluding specific queries from analysis](#excluding-specific-queries-from-analysis)" below. {% endtip %} -{% endif %} You can run extra queries if they are part of a {% data variables.product.prodname_codeql %} pack published to the {% data variables.product.company_short %} {% data variables.product.prodname_container_registry %} or a {% data variables.product.prodname_codeql %} pack stored in a repository. For more information, see "[AUTOTITLE](/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql#about-codeql-queries)."