From 48ae6ccba362b5f17655eaa2a08d27c9a29d6cc6 Mon Sep 17 00:00:00 2001 From: hubwriter <54933897+hubwriter@users.noreply.github.com> Date: Tue, 13 Oct 2020 10:47:11 +0100 Subject: [PATCH] [Already shipped] Code scanning: Restructure 'Integrating with code scanning' category (#15971) * Restructure files and change topic titles and file names * Update links to files whose names have changed * Finish restructuring work for runner topics * Makes changes suggested by James --- ...nfiguring-code-scanning-for-your-appliance.md | 2 +- .../about-integration-with-code-scanning.md | 8 +++----- .../configuring-code-scanning.md | 4 ++-- ...ng-codeql-code-scanning-in-your-ci-system.md} | 10 ++++++---- .../index.md | 7 ++++--- .../integrating-with-code-scanning.md | 2 +- ...ng-codeql-code-scanning-in-your-ci-system.md} | 16 +++++++++++----- .../sarif-support-for-code-scanning.md | 10 +++++----- ...ng-codeql-code-scanning-in-your-ci-system.md} | 6 ++++-- .../uploading-a-sarif-file-to-github.md | 4 ++-- ...code-scanning-with-your-existing-ci-system.md | 11 +++++++++++ 11 files changed, 50 insertions(+), 30 deletions(-) rename content/github/finding-security-vulnerabilities-and-errors-in-your-code/{configuring-code-scanning-in-your-ci-system.md => configuring-codeql-code-scanning-in-your-ci-system.md} (92%) rename content/github/finding-security-vulnerabilities-and-errors-in-your-code/{running-code-scanning-in-your-ci-system.md => running-codeql-code-scanning-in-your-ci-system.md} (90%) rename content/github/finding-security-vulnerabilities-and-errors-in-your-code/{troubleshooting-code-scanning-in-your-ci-system.md => troubleshooting-codeql-code-scanning-in-your-ci-system.md} (93%) create mode 100644 content/github/finding-security-vulnerabilities-and-errors-in-your-code/using-codeql-code-scanning-with-your-existing-ci-system.md diff --git a/content/admin/configuration/configuring-code-scanning-for-your-appliance.md b/content/admin/configuration/configuring-code-scanning-for-your-appliance.md index 6ac054a7e368..95ca6a245aa3 100644 --- a/content/admin/configuration/configuring-code-scanning-for-your-appliance.md +++ b/content/admin/configuration/configuring-code-scanning-for-your-appliance.md @@ -71,7 +71,7 @@ After you configure a self-hosted runner, users can enable {% data variables.pro ### Running {% data variables.product.prodname_code_scanning %} using the {% data variables.product.prodname_codeql_runner %} If your organization isn't taking part in the beta for {% data variables.product.prodname_actions %}, or if you don't want to use {% data variables.product.prodname_actions %}, you can run {% data variables.product.prodname_code_scanning %} using the {% data variables.product.prodname_codeql_runner %}. -The {% data variables.product.prodname_codeql_runner %} is a command-line tool that you can add to your third-party CI/CD system. The tool runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. For more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)." +The {% data variables.product.prodname_codeql_runner %} is a command-line tool that you can add to your third-party CI/CD system. The tool runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. For more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)." ### Disabling {% data variables.product.prodname_code_scanning %} diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning.md index 286e546ae099..0ec171b4162b 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/about-integration-with-code-scanning.md @@ -13,8 +13,6 @@ versions: As an alternative to running {% data variables.product.prodname_code_scanning %} within {% data variables.product.prodname_dotcom %}, you can perform analysis elsewhere and then upload the results. Alerts for {% data variables.product.prodname_code_scanning %} that you run externally are displayed in the same way as those for {% data variables.product.prodname_code_scanning %} that you run within {% data variables.product.prodname_dotcom %}. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)." -You can use your continuous integration or continuous delivery/deployment (CI/CD) system to run {% data variables.product.prodname_dotcom %}'s {% data variables.product.prodname_codeql %} analysis and upload the results to {% data variables.product.prodname_dotcom %}. This is an alternative to using {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_codeql %} analysis. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)." - If you use a third-party static analysis tool that can produce results as Static Analysis Results Interchange Format (SARIF) 2.1.0 data, you can upload this to {% data variables.product.prodname_dotcom %}. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)." ### Integrations with webhooks @@ -23,6 +21,6 @@ You can use {% data variables.product.prodname_code_scanning %} webhooks to buil ### Further reading -* "[About code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)" -* "[Configuring code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)" -* "[SARIF support for code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning)" +* "[About {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)" +* "[Using {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI system +* "[SARIF support for {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning)" diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md index a64a43deb165..7906c341ae70 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning.md @@ -14,9 +14,9 @@ versions: ### About {% data variables.product.prodname_code_scanning %} configuration -You can run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_location %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)." +You can run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_location %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)." -This article relates to running {% data variables.product.prodname_code_scanning %} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_ghe_server %}{% else %}{% data variables.product.prodname_dotcom %}{% endif %}. +This article is about running {% data variables.product.prodname_code_scanning %} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_ghe_server %}{% else %}{% data variables.product.prodname_dotcom %}{% endif %}. Before you can configure {% data variables.product.prodname_code_scanning %} for a repository, you must enable {% data variables.product.prodname_code_scanning %} by adding a {% data variables.product.prodname_actions %} workflow to the repository. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)." diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system.md similarity index 92% rename from content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system.md rename to content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system.md index ea3d32b11671..492b672a0332 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system.md @@ -1,9 +1,11 @@ --- -title: Configuring code scanning in your CI system +title: Configuring CodeQL code scanning in your CI system shortTitle: Configuring in your CI intro: 'You can configure how the {% data variables.product.prodname_codeql_runner %} scans the code in your project and uploads the results to {% data variables.product.prodname_dotcom %}.' product: '{% data reusables.gated-features.code-scanning %}' miniTocMaxHeadingLevel: 4 +redirect_from: + - /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system versions: free-pro-team: '*' enterprise-server: '>=2.22' @@ -13,9 +15,9 @@ versions: {% data reusables.code-scanning.beta %} {% data reusables.code-scanning.enterprise-enable-code-scanning %} -### About {% data variables.product.prodname_code_scanning %} configuration in your CI system +### About configuring {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system -To integrate {% data variables.product.prodname_code_scanning %} into your CI system, you can use the {% data variables.product.prodname_codeql_runner %}. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)." +To integrate {% data variables.product.prodname_code_scanning %} into your CI system, you can use the {% data variables.product.prodname_codeql_runner %}. For more information, see "[Running {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)." In general, you invoke the {% data variables.product.prodname_codeql_runner %} as follows. @@ -89,7 +91,7 @@ The `autobuild` process only ever attempts to build _one_ compiled language for $ /path/to-runner/codeql-runner-linux autobuild --language csharp ``` -If the `autobuild` command can't build your code, you can run the build steps yourself, between the `init` and `analyze` steps. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system#compiled-language-example)." +If the `autobuild` command can't build your code, you can run the build steps yourself, between the `init` and `analyze` steps. For more information, see "[Running {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system#compiled-language-example)." ### Uploading {% data variables.product.prodname_code_scanning %} data to {% data variables.product.prodname_dotcom %} diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md index 55e494070e08..1107de21b205 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/index.md @@ -20,8 +20,9 @@ versions: {% link_in_list /troubleshooting-the-codeql-workflow %} {% topic_link_in_list /integrating-with-code-scanning %} {% link_in_list /about-integration-with-code-scanning %} - {% link_in_list /running-code-scanning-in-your-ci-system %} - {% link_in_list /configuring-code-scanning-in-your-ci-system %} - {% link_in_list /troubleshooting-code-scanning-in-your-ci-system %} {% link_in_list /uploading-a-sarif-file-to-github %} {% link_in_list /sarif-support-for-code-scanning %} +{% topic_link_in_list /using-codeql-code-scanning-with-your-existing-ci-system %} + {% link_in_list /running-codeql-code-scanning-in-your-ci-system %} + {% link_in_list /configuring-codeql-code-scanning-in-your-ci-system %} + {% link_in_list /troubleshooting-codeql-code-scanning-in-your-ci-system %} diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/integrating-with-code-scanning.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/integrating-with-code-scanning.md index b352f573e26b..01a082e5015f 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/integrating-with-code-scanning.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/integrating-with-code-scanning.md @@ -1,7 +1,7 @@ --- title: Integrating with code scanning shortTitle: Integration -intro: 'You can integrate {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI systems or upload results from other tools.' +intro: 'You can integrate third-party code analysis tools with {% data variables.product.prodname_dotcom %} {% data variables.product.prodname_code_scanning %} by uploading data as SARIF files.' mapTopic: true product: '{% data reusables.gated-features.code-scanning %}' redirect_from: diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system.md similarity index 90% rename from content/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system.md rename to content/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system.md index ca6cebabd97b..5b7faf0e62b0 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system.md @@ -1,8 +1,10 @@ --- -title: Running code scanning in your CI system +title: Running CodeQL code scanning in your CI system shortTitle: Running in your CI -intro: 'If you use a third-party continuous integration system, you can integrate {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} into this system using the {% data variables.product.prodname_codeql_runner %}.' +intro: 'You can use the {% data variables.product.prodname_codeql_runner %} to perform {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in a third-party continuous integration system.' product: '{% data reusables.gated-features.code-scanning %}' +redirect_from: + - /github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system versions: free-pro-team: '*' enterprise-server: '>=2.22' @@ -12,6 +14,10 @@ versions: {% data reusables.code-scanning.beta %} {% data reusables.code-scanning.enterprise-enable-code-scanning %} +### Using {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI system + +If you use a continuous integration or continuous delivery/deployment (CI/CD) system other than {% data variables.product.prodname_actions %}, you can use your existing system to run {% data variables.product.prodname_dotcom %}'s {% data variables.product.prodname_codeql %} analysis and upload the results to {% data variables.product.prodname_dotcom %}. To do this, use the {% data variables.product.prodname_codeql_runner %}. + ### About the {% data variables.product.prodname_codeql_runner %} {% data reusables.code-scanning.about-code-scanning %} For information, see "[About {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)." @@ -73,7 +79,7 @@ For both commands, you must specify the URL of {% data variables.product.product You can configure where the {% data variables.product.prodname_codeql_runner %} stores the CodeQL bundle for future analysis on a server using the `--tools-dir` flag and where it stores temporary files during analysis using `--temp-dir`. -To view the command-line reference for the runner, use the `-h` flag. For example, to list all commands run: `codeql-runner-OS -h`, or to list all the flags available for the `init` command run: `codeql-runner-OS init -h` (where `OS` varies according to the executable that you are using). For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system#codeql-runner-command-reference)." +To view the command-line reference for the runner, use the `-h` flag. For example, to list all commands run: `codeql-runner-OS -h`, or to list all the flags available for the `init` command run: `codeql-runner-OS init -h` (where `OS` varies according to the executable that you are using). For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system#codeql-runner-command-reference)." #### Basic example @@ -151,5 +157,5 @@ This example is similar to the previous example, however this time the repositor ### Further reading -- "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)" -- "[Troubleshooting {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system)" +- "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system)" +- "[Troubleshooting {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system)" diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning.md index 18165bcbed72..ab7f73887242 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning.md @@ -1,7 +1,7 @@ --- title: SARIF support for code scanning shortTitle: SARIF support -intro: 'To display results from a third-party static analysis tool in your repository on {% data variables.product.prodname_dotcom %}, you''ll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for code scanning. If you use the default {% data variables.product.prodname_codeql %} static analysis engine, then your results will display in your repository on {% data variables.product.prodname_dotcom %} automatically.' +intro: 'To display results from a third-party static analysis tool in your repository on {% data variables.product.prodname_dotcom %}, you''ll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for {% data variables.product.prodname_code_scanning %}. If you use the default {% data variables.product.prodname_codeql %} static analysis engine, then your results will display in your repository on {% data variables.product.prodname_dotcom %} automatically.' product: '{% data reusables.gated-features.code-scanning %}' redirect_from: - /github/finding-security-vulnerabilities-and-errors-in-your-code/about-sarif-support-for-code-scanning @@ -16,9 +16,9 @@ versions: SARIF (Static Analysis Results Interchange Format) is an [OASIS Standard](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) that defines an output file format. The SARIF standard is used to streamline how static analysis tools share their results. {% data variables.product.prodname_code_scanning_capc %} supports a subset of the SARIF 2.1.0 JSON schema. -To upload a SARIF file from a third-party static code analysis engine, you'll need to ensure that uploaded files use the SARIF 2.1.0 version. {% data variables.product.prodname_dotcom %} will parse the SARIF file and show alerts using the results in your repository as a part of the code scanning experience. For more information, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)." For more information about the SARIF 2.1.0 JSON schema, see [`sarif-schema-2.1.0.json`](https://github.com/oasis-tcs/sarif-spec/blob/master/Schemata/sarif-schema-2.1.0.json). +To upload a SARIF file from a third-party static code analysis engine, you'll need to ensure that uploaded files use the SARIF 2.1.0 version. {% data variables.product.prodname_dotcom %} will parse the SARIF file and show alerts using the results in your repository as a part of the {% data variables.product.prodname_code_scanning %} experience. For more information, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)." For more information about the SARIF 2.1.0 JSON schema, see [`sarif-schema-2.1.0.json`](https://github.com/oasis-tcs/sarif-spec/blob/master/Schemata/sarif-schema-2.1.0.json). -If you're using {% data variables.product.prodname_actions %} with the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning)" or "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)." +If you're using {% data variables.product.prodname_actions %} with the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning)" or "[Running {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)." {% data variables.product.prodname_dotcom %} uses properties in the SARIF file to display alerts. For example, the `shortDescription` and `fullDescription` appear at the top of a {% data variables.product.prodname_code_scanning %} alert. The `location` allows {% data variables.product.prodname_dotcom %} to show annotations in your code file. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)." @@ -32,11 +32,11 @@ Each time the results of a new code scan are uploaded, the results are processed SARIF files created by the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {% data variables.product.prodname_dotcom %} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions)." -If you upload a SARIF file without fingerprint data using the `/code-scanning/sarifs` API endpoint, the code scanning alerts will be processed and displayed, but users may see duplicate alerts. To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the `partialFingerprints` property before you upload the SARIF file. You may find the script that the `upload-sarif` action uses a helpful starting point: https://github.com/github/codeql-action/blob/main/src/fingerprints.ts. For more information about the API, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)." +If you upload a SARIF file without fingerprint data using the `/code-scanning/sarifs` API endpoint, the {% data variables.product.prodname_code_scanning %} alerts will be processed and displayed, but users may see duplicate alerts. To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the `partialFingerprints` property before you upload the SARIF file. You may find the script that the `upload-sarif` action uses a helpful starting point: https://github.com/github/codeql-action/blob/main/src/fingerprints.ts. For more information about the API, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)." ### Validating your SARIF file -You can check a SARIF file is compatible with code scanning by testing it against the GitHub ingestion rules. For more information, visit the [Microsoft SARIF validator](https://sarifweb.azurewebsites.net/). +You can check a SARIF file is compatible with {% data variables.product.prodname_code_scanning %} by testing it against the {% data variables.product.prodname_dotcom %} ingestion rules. For more information, visit the [Microsoft SARIF validator](https://sarifweb.azurewebsites.net/). ### Supported SARIF output file properties diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system.md similarity index 93% rename from content/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system.md rename to content/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system.md index 70157b029eb8..80a3cf55af10 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system.md @@ -1,8 +1,10 @@ --- -title: Troubleshooting code scanning in your CI system +title: Troubleshooting CodeQL code scanning in your CI system shortTitle: Troubleshooting in your CI intro: 'If you''re having problems with the {% data variables.product.prodname_codeql_runner %}, you can troubleshoot by using these tips.' product: '{% data reusables.gated-features.code-scanning %}' +redirect_from: + - /github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system versions: free-pro-team: '*' enterprise-server: '>=2.22' @@ -24,7 +26,7 @@ To avoid this automatic download, you can manually download the {% data variable If the `analyze` command for the {% data variables.product.prodname_codeql_runner %} fails with an error `No source code was seen during the build`, this indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code. Several reasons can explain such a failure. -1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by using the `--languages` flag of the `init` command. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)." +1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by using the `--languages` flag of the `init` command. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system)." 1. You're analyzing a compiled language without using the `autobuild` command and you run the build steps yourself after the `init` step. For the build to work, you must set up the environment such that the {% data variables.product.prodname_codeql_runner %} can monitor the code. The `init` command generates instructions for how to export the required environment variables, so you can copy and run the script after you've run the `init` command. - On macOS and Linux: diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github.md index c3a1e7245acc..4b900eaf08fe 100644 --- a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github.md +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github.md @@ -24,7 +24,7 @@ You can upload the results using {% data variables.product.prodname_actions %}{% - {% data variables.product.prodname_actions %} to run the {% data variables.product.prodname_codeql %} action, there is no further action required. The {% data variables.product.prodname_codeql %} action uploads the SARIF file automatically when it completes analysis. - {% data variables.product.prodname_actions %} to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below). -- The {% data variables.product.prodname_codeql_runner %}, to run {% data variables.product.prodname_code_scanning %} in your CI system, by default the runner automatically uploads results to {% data variables.product.prodname_dotcom %} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)"). +- The {% data variables.product.prodname_codeql_runner %}, to run {% data variables.product.prodname_code_scanning %} in your CI system, by default the runner automatically uploads results to {% data variables.product.prodname_dotcom %} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)"). - A tool that generates results as an artifact outside of your repository, you can use the {% data variables.product.prodname_code_scanning %} API to upload the file (for more information, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)"). ### Uploading a {% data variables.product.prodname_code_scanning %} analysis with {% data variables.product.prodname_actions %} @@ -110,5 +110,5 @@ jobs: - "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions)" - "[Viewing your workflow history](/actions/managing-workflow-runs/viewing-workflow-run-history)" -- "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)" +- "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)" - "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)" diff --git a/content/github/finding-security-vulnerabilities-and-errors-in-your-code/using-codeql-code-scanning-with-your-existing-ci-system.md b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/using-codeql-code-scanning-with-your-existing-ci-system.md new file mode 100644 index 000000000000..af71f4047d5b --- /dev/null +++ b/content/github/finding-security-vulnerabilities-and-errors-in-your-code/using-codeql-code-scanning-with-your-existing-ci-system.md @@ -0,0 +1,11 @@ +--- +title: Using CodeQL code scanning with your existing CI system +shortTitle: CodeQL CI system support +intro: 'The {% data variables.product.prodname_codeql_runner %} allows you to use your existing CI system to run {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}.' +mapTopic: true +product: '{% data reusables.gated-features.code-scanning %}' +versions: + free-pro-team: '*' + enterprise-server: '>=2.22' +--- +