8000 v0.4 · advanced-security/gh-codeql-scan@40f6e0f · GitHub
[go: up one dir, main page]
Skip to content

Commit 40f6e0f

Browse files
GeekMasherGeekMasher
committed
v0.4
- Auto-install CodeQL via gh-cli - Set auto-detect lang to enabled by default - Better banner and help prompt - Better stdout support
1 parent 60640ff commit 40f6e0f

File tree

3 files changed

+113
-45
lines changed

3 files changed

+113
-45
lines changed

‎bin/codeql-init

+2-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ for CODEQL_LANGUAGE in ${CODEQL_LANGUAGES//,/ } ; do
7070

7171
CODEQL_GITHUB_REPOSITORY=$(echo $GITHUB_REPOSITORY | tr '/' '_')
7272
CODEQL_DATABASE="$CODEQL_DATABASES/${CODEQL_LANGUAGE}-${CODEQL_GITHUB_REPOSITORY}"
73-
echo "CodeQL Database Name :: $CODEQL_DATABASE"
73+
74+
info "CodeQL Database Name :: $CODEQL_DATABASE"
7475

7576
if [ -d $CODEQL_DATABASES ] ; then
7677
info "Deleting old database :: $CODEQL_DATABASE"

‎bin/codeql-utils

+64-6
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,85 @@
22

33
set -e
44

5+
display-banner() {
6+
if [ ! -z ${CODEQL_SCAN_BANNER+x} ] && [ "$CODEQL_SCAN_BANNER" = "0" ]; then
7+
return
8+
fi
9+
echo " _____ _ _____ _ _____"
10+
echo " / __ \ | | | _ | | / ___|"
11+
echo " | / \/ ___ __| | ___ | | | | | \ \`--. ___ __ _ _ __"
12+
echo " | | / _ \ / _\` \|/ _ | | | | | \`--. \/ __/ _\` | '_ \\"
13+
echo " | \__/\ (_) | (_| | __/\ \/' / |____ /\__/ / (_| (_| | | | |"
14+
echo " \____/\___/ \__,_|\___| \_/\_\_____/ \____/ \___\__,_|_| |_|"
15+
echo " v$CODEQL_SCAN_VERSION - by GitHub Field Security Specialist team"
16+
echo ""
17+
}
18+
19+
codeql-scan-help() {
20+
cat <<EOF
21+
GitHub CodeQL Scan tool
22+
23+
gh codeql-scan {MODE} {ARGS}
24+
25+
gh codeql-scan # default: "scan"
26+
gh codeql-scan init # initialise the scan
27+
gh codeql-scan analyze # run the analysis
28+
gh codeql-scan upload # upload present SARIF files
29+
gh codeql-scan scan # full end-to-end scan
30+
EOF
31+
}
32+
33+
# https://unix.stackexchange.com/questions/9957/how-to-check-if-bash-can-print-colors
34+
if test -t 1; then
35+
ncolors=$(tput colors)
36+
if test -n "$ncolors" && test $ncolors -ge 8; then
37+
bold="$(tput bold)"
38+
underline="$(tput smul)"
39+
standout="$(tput smso)"
40+
normal="$(tput sgr0)"
41+
black="$(tput setaf 0)"
42+
red="$(tput setaf 1)"
43+
green="$(tput setaf 2)"
44+
yellow="$(tput setaf 3)"
45+
blue="$(tput setaf 4)"
46+
magenta="$(tput setaf 5)"
47+
cyan="$(tput setaf 6)"
48+
white="$(tput setaf 7)"
49+
fi
50+
fi
51+
52+
# Printing methods for stdout
553

654
info() {
7-
echo "[+] $@"
55+
echo "${green}[+]${normal} $@"
856
}
957
debug() {
1058
if [ ! -z ${DEBUG+x} ]; then
11-
echo "[#] DEBUG: $@"
59+
echo "${blue}[#] DEBUG: $@${normal}"
1260
fi
1361
}
1462
warning() {
15-
echo "[!] WARNING: $@"
63+
echo "${yellow}[!] WARNING: $@${normal}"
1664
}
1765
error() {
18-
echo "[*] ERROR: $@"
66+
echo "${red}[*] ERROR: $@${normal}"
1967
}
2068

2169

22-
install-codeql() {
70+
# CodeQL methods
71+
72+
codeql-install() {
73+
# https://github.com/GeekMasher/.dotfiles/blob/d08a1525c624e88b4d686cf70da349616d2b8aa4/codeql/.local/codeql-update
2374
info "Installing CodeQL via gh-cli..."
2475
gh extensions install github/gh-codeql
76+
gh codeql set-version latest
77+
78+
# install new packs for each language
79+
LANGS="cpp,csharp,go,java,javascript,python,ruby"
80+
for lang in $(echo $LANGS | sed "s/,/ /g"); do
81+
gh codeql pack download "codeql/$lang-queries"
82+
done
83+
info "CodeQL installed!"
2584
}
2685

2786
find-codeql() {
@@ -31,5 +90,4 @@ find-codeql() {
3190

3291
get-languages() {
3392
echo "TODO"
34-
3593
}

‎gh-codeql-scan

+47-38
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ export EXTENSION_LOCATION="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
44

55
source $EXTENSION_LOCATION/bin/codeql-utils
66

7+
# >> CodeQL Scan
8+
export CODEQL_SCAN_VERSION="0.4.0"
9+
# enabled by default
10+
export CODEQL_SCAN_BANNER=1
11+
712
# >> CodeQL
813
export CODEQL_DATABASES="${CODEQL_DATABASES:=$HOME/.codeql/databases}"
914
# Override the database if it exists
@@ -21,11 +26,11 @@ export CODEQL_DATABASE_PATHS_FILE="${CODEQL_DATABASE_PATHS_FILE:=/tmp/codeql-dat
2126
export WORKSPACE="${WORKSPACE:=$PWD}"
2227

2328
# >> GitHub
24-
export GITHUB_INSTANCE="https://github.com"
29+
export GITHUB_INSTANCE=${GITHUB_INSTANCE:="https://github.com"}
2530
# upload by default
26-
export GITHUB_UPLOAD=1
27-
# do not auto-detect languages
28-
export GITHUB_AUTO_DETECT=0
31+
export GITHUB_UPLOAD=${GITHUB_UPLOAD:=1}
32+
# auto-detect languages
33+
export GITHUB_AUTO_DETECT=${GITHUB_AUTO_DETECT:=1}
2934

3035
# Git Based metadata
3136
export GIT_HASH=$(git rev-parse HEAD)
@@ -34,34 +39,17 @@ export GIT_HASH=$(git rev-parse HEAD)
3439
export GIT_REF="refs/heads/$(git branch --show-current)"
3540

3641

37-
codeql-scan-help() {
38-
cat <<EOF
39-
GitHub CodeQL Scan tool
40-
41-
gh codeql-scan {MODE} {ARGS}
42-
43-
gh codeql-scan # default: "scan"
44-
gh codeql-scan init # initialise the scan
45-
gh codeql-scan analyze # run the analysis
46-
gh codeql-scan upload # upload present SARIF files
47-
gh codeql-scan scan # full end-to-end scan
48-
EOF
49-
}
50-
51-
52-
5342
# default: scan
5443
MODE="scan"
5544
if [ -z ${1+x} ]; then
5645
debug "Using default mode"
57-
5846
elif [[ "${1}" = "--help" ]]; then
5947
codeql-scan-help
6048
exit 0
6149
elif [[ "${1}" =~ ^(init|analyze|scan|upload) ]]; then
6250
MODE="$1"
51+
debug "Using mode :: $MODE"
6352
shift
64-
6553
fi
6654

6755
# parse other arguments
@@ -87,6 +75,10 @@ for i in "$@"; do
8775
export GITHUB_UPLOAD=0
8876
shift
8977
;;
78+
--disable-banner)
79+
export CODEQL_SCAN_BANNER=0
80+
shift
81+
;;
9082
-l=*|--language=*)
9183
export CODEQL_LANGUAGES="${i#*=}"
9284
shift
@@ -122,6 +114,23 @@ for i in "$@"; do
122114
done
123115

124116

117+
display-banner
118+
119+
# Check if CodeQL is installed and have a version
120+
CODEQL_VERSION="$($CODEQL_BINARY version --format=terse || echo '')"
121+
122+
if [ "$CODEQL_VERSION" = "" ]; then
123+
warning "CodeQL is not installed, now installing automatically..."
124+
125+
codeql-install
126+
127+
export CODEQL_BINARY="gh codeql"
128+
export CODEQL_VERSION=$($CODEQL_BINARY version --format=terse)
129+
fi
130+
131+
debug "Using CodeQL binary :: $CODEQL_BINARY"
132+
info "Using CodeQL version :: $CODEQL_VERSION"
133+
125134
# Output dirs
126135
info "Storing CodeQL databases :: $CODEQL_DATABASES"
127136
if [ ! -d $CODEQL_DATABASES ]; then
@@ -139,42 +148,42 @@ if [ -z ${GITHUB_REPOSITORY+x} ]; then
139148
# TODO: support for ssh remotes
140149
export GITHUB_REPOSITORY=$(echo $REMOTE | sed -e 's/.*github.com[:\/]\(.*\)\.git/\1/')
141150

142-
echo "Using remote repository: $GITHUB_REPOSITORY"
151+
info "Using remote repository: $GITHUB_REPOSITORY"
143152
fi
144153

145154

155+
# Running different modes
146156
if [ $MODE = "init" ]; then
147-
echo "Running Init mode..."
148-
149-
#$HERE/bin/codeql-config.sh
150-
$EXTENSION_LOCATION/bin/codeql-init
157+
info "Running Init mode..."
158+
159+
$EXTENSION_LOCATION/bin/codeql-init $@
151160

152161
elif [ $MODE = "analyze" ]; then
153-
echo "Running Analyze mode..."
162+
info "Running Analyze mode..."
154163

155164
$EXTENSION_LOCATION/bin/codeql-analyze $@
156165

157166
elif [ $MODE = "upload" ]; then
158-
echo "Uploading results to GitHub..."
167+
info "Uploading results to GitHub..."
159168

160-
$EXTENSION_LOCATION/bin/codeql-upload
169+
$EXTENSION_LOCATION/bin/codeql-upload $@
161170

162171
elif [ $MODE = "scan" ]; then
163-
echo "Running Scan mode..."
172+
info "Running Scan mode..."
164173

165174
debug "Disable build tracing as it can not be used in this mode"
166175
export CODEQL_TRACING=0
167-
176+
168177
$EXTENSION_LOCATION/bin/codeql-init $@
169178

170179
$EXTENSION_LOCATION/bin/codeql-analyze $@
171180

172181
if [ "$GITHUB_UPLOAD" = "1" ]; then
173-
echo "Uploading results to GitHub..."
174-
$EXTENSION_LOCATION/bin/codeql-upload
182+
info "Uploading results to GitHub..."
183+
$EXTENSION_LOCATION/bin/codeql-upload $@
184+
else
185+
debug "Results are not uploaded to GitHub"
175186
fi
176-
else
177-
echo "ERROR: Mode is not supported"
178-
codeql-scan-help
179-
exit 1
180187
fi
188+
189+
info "Completed CodeQL Scan!"

0 commit comments

Comments
 (0)
0