Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions actions/extractor/codeql-extractor.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
name: "actions"
aliases: []
display_name: "GitHub Actions"
version: 0.0.1
column_kind: "utf16"
Expand All @@ -8,9 +7,11 @@ build_modes:
- none
default_queries:
- codeql/actions-queries
file_coverage_languages: []
# Actions workflows are not reported separately by the GitHub API, so we can't
# associate them with a specific language.
github_api_languages: []
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it worth putting a comment here that actions isn't its own language as far as linguist/the API is concerned and therefore not listed?

scc_languages: []
scc_languages:
- YAML
Comment on lines +13 to +14
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can see that this is now consistent with other languages. What effect does adding this have?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This tells scc to pick up files marked as YAML when CodeQL scans for the baseline set of files. These are then further filtered down by the configure baseline script.

file_types:
- name: workflow
display_name: GitHub Actions workflow files
Expand Down
10 changes: 10 additions & 0 deletions actions/extractor/tools/baseline-config.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{
"paths": [
".github/workflows/*.yml",
".github/workflows/*.yaml",
".github/reusable_workflows/**/*.yml",
".github/reusable_workflows/**/*.yaml",
"**/action.yml",
"**/action.yaml"
]
}
2 changes: 2 additions & 0 deletions actions/extractor/tools/configure-baseline.cmd
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
@echo off
type "%CODEQL_EXTRACTOR_ACTIONS_ROOT%\tools\baseline-config.json"
3 changes: 3 additions & 0 deletions actions/extractor/tools/configure-baseline.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
#!/bin/sh

cat "$CODEQL_EXTRACTOR_ACTIONS_ROOT/tools/baseline-config.json"
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
ql/actions/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
ql/actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
ql/actions/ql/src/Debug/SyntaxError.ql
ql/actions/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
ql/actions/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
Expand Down
13 changes: 13 additions & 0 deletions actions/ql/src/Diagnostics/SuccessfullyExtractedFiles.ql
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
/**
* @id actions/diagnostics/successfully-extracted-files
* @name Extracted files
* @description List all files that were extracted.
* @kind diagnostic
* @tags successfully-extracted-files
*/

private import codeql.Locations

from File f
where exists(f.getRelativePath())
select f, ""
Comment on lines +11 to +13

Check warning

Code scanning / CodeQL

Consistent alert message Warning

The actions/diagnostics/successfully-extracted-files query does not have the same alert message as cpp, rust, swift.
4 changes: 4 additions & 0 deletions actions/ql/src/change-notes/2025-09-05-file-coverage.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Actions analysis now reports file coverage information on the CodeQL status page.