Skip to content

Commit 48c716c

Browse files
authored
Remove redundant versioning for code scanning (#52352)
1 parent d6261d3 commit 48c716c

18 files changed

+27
-105
lines changed

Diff for: content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md

+3-17
Original file line numberDiff line numberDiff line change
@@ -296,8 +296,6 @@ In this example, the default queries will be run for Java, as well as the querie
296296

297297
{% data reusables.code-scanning.run-additional-queries %}
298298

299-
{% ifversion codeql-packs %}
300-
301299
### Using query packs
302300

303301
To add one or more {% data variables.product.prodname_codeql %} query packs, add a `with: packs:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. Within `packs` you specify one or more packages to use and, optionally, which version to download. Where you don't specify a version, the latest version is downloaded. If you want to use packages that are not publicly available, you need to set the `GITHUB_TOKEN` environment variable to a secret that has access to the packages. For more information, see "[AUTOTITLE](/actions/security-guides/automatic-token-authentication)" and "[AUTOTITLE](/actions/security-guides/encrypted-secrets)."
@@ -321,7 +319,6 @@ In the example below, `scope` is the organization or personal account that publi
321319
packs: scope/pack1,scope/pack2@1.2.3,scope/pack3@~3.2.1,scope/pack4@4.5.6:path/to/queries
322320
```
323321

324-
{% ifversion query-pack-compatibility %}
325322
{% note %}
326323

327324
**Note:** If you specify a particular version of a query pack to use,
@@ -334,7 +331,6 @@ To ensure optimal performance, if you need to specify exact query pack versions,
334331
For more information about pack compatibility, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs#about-codeql-pack-compatibility)."
335332

336333
{% endnote %}
337-
{% endif %}
338334

339335
### Downloading {% data variables.product.prodname_codeql %} packs from {% data variables.product.prodname_ghe_server %}
340336

@@ -370,7 +366,6 @@ Notice the `|` after the `registries` property name. This is important since {%
370366

371367
### Using queries in QL packs
372368

373-
{% endif %}
374369
To add one or more queries, add a `with: queries:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. If the queries are in a private repository, use the `external-repository-token` parameter to specify a token that has access to checkout the private repository.
375370

376371
You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language.
@@ -388,24 +383,18 @@ You can also specify query suites in the value of `queries`. Query suites are co
388383

389384
{% data reusables.code-scanning.codeql-query-suites-explanation %}
390385

391-
{% ifversion codeql-packs %}
392-
393386
### Working with custom configuration files
394387

395-
{% endif %}
396-
397-
If you also use a configuration file for custom settings, any additional {% ifversion codeql-packs %}packs or {% endif %}queries specified in your workflow are used instead of those specified in the configuration file. If you want to run the combined set of additional {% ifversion codeql-packs %}packs or {% endif %}queries, prefix the value of {% ifversion codeql-packs %}`packs` or {% endif %}`queries` in the workflow with the `+` symbol. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)."
388+
If you also use a configuration file for custom settings, any additional packs or queries specified in your workflow are used instead of those specified in the configuration file. If you want to run the combined set of additional packs or queries, prefix the value of `packs` or `queries` in the workflow with the `+` symbol. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)."
398389

399-
In the following example, the `+` symbol ensures that the specified additional {% ifversion codeql-packs %}packs and {% endif %}queries are used together with any specified in the referenced configuration file.
390+
In the following example, the `+` symbol ensures that the specified additional packs and queries are used together with any specified in the referenced configuration file.
400391

401392
``` yaml copy
402393
- uses: {% data reusables.actions.action-codeql-action-init %}
403394
with:
404395
config-file: ./.github/codeql/codeql-config.yml
405396
queries: +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main
406-
{%- ifversion codeql-packs %}
407397
packs: +scope/pack1,scope/pack2@1.2.3,scope/pack3@4.5.6:path/to/queries
408-
{%- endif %}
409398
```
410399
<!-- Anchor to maintain the current CodeQL CLI manual pages link: https://aka.ms/code-scanning-docs/config-file -->
411400
<a name="using-a-custom-configuration-file"></a>
@@ -415,7 +404,7 @@ In the following example, the `+` symbol ensures that the specified additional {
415404

416405
## Using a custom configuration file
417406

418-
A custom configuration file is an alternative way to specify additional {% ifversion codeql-packs %}packs and {% endif %}queries to run. You can also use the file to disable the default queries{% ifversion code-scanning-exclude-queries-from-analysis %}, exclude or include specific queries,{% endif %} and to specify which directories to scan during analysis.
407+
A custom configuration file is an alternative way to specify additional packs and queries to run. You can also use the file to disable the default queries{% ifversion code-scanning-exclude-queries-from-analysis %}, exclude or include specific queries,{% endif %} and to specify which directories to scan during analysis.
419408

420409
In the workflow file, use the `config-file` parameter of the `init` action to specify the path to the configuration file you want to use. This example loads the configuration file _./.github/codeql/codeql-config.yml_.
421410

@@ -437,8 +426,6 @@ If the configuration file is located in an external private repository, use the
437426

438427
The settings in the configuration file are written in YAML format.
439428

440-
{% ifversion codeql-packs %}
441-
442429
### Specifying {% data variables.product.prodname_codeql %} query packs
443430

444431
You specify {% data variables.product.prodname_codeql %} query packs in an array. Note that the format is different from the format used by the workflow file.
@@ -482,7 +469,6 @@ packs:
482469
```
483470

484471
{% endraw %}
485-
{% endif %}
486472

487473
{% ifversion codeql-threat-models %}
488474

Diff for: content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md

+1-15
Original file line numberDiff line numberDiff line change
@@ -55,27 +55,13 @@ If you configure {% data variables.product.prodname_code_scanning %} using {% da
5555

5656
When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_caps %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.
5757

58-
### About {% ifversion remove-code-scanning-configurations %}alerts from multiple configurations{% else %}analysis origins{% endif %}
58+
### About alerts from multiple configurations
5959

60-
{% ifversion remove-code-scanning-configurations %}
6160
You can run multiple configurations of code analysis on a repository, using different tools and targeting different languages or areas of the code. Each configuration of {% data variables.product.prodname_code_scanning %} generates a unique set of alerts. For example, an alert generated using the default {% data variables.product.prodname_codeql %} analysis with {% data variables.product.prodname_actions %} comes from a different configuration than an alert generated externally and uploaded via the {% data variables.product.prodname_code_scanning %} API.
6261

6362
If you use multiple configurations to analyze a file, any problems detected by the same query are reported as alerts generated by multiple configurations. If an alert exists in more than one configuration, the number of configurations appears next to the branch name in the "Affected branches" section on the right-hand side of the alert page. To view the configurations for an alert, in the "Affected branches" section, click a branch. A "Configurations analyzing" modal appears with the names of each configuration generating the alert for that branch. Below each configuration, you can see when that configuration's alert was last updated.
6463

6564
An alert may display different statuses from different configurations. To update the alert statuses, re-run each out-of-date configuration. Alternatively, you can delete stale configurations from a branch to remove outdated alerts. For more information on deleting stale configurations and alerts, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch)."
66-
{% else %}
67-
You can run multiple configurations of code analysis on a repository, using different tools and targeting different languages or areas of the code. Each configuration of {% data variables.product.prodname_code_scanning %} is the analysis origin for all the alerts it generates. For example, an alert generated using the default {% data variables.product.prodname_codeql %} analysis with {% data variables.product.prodname_actions %} will have a different analysis origin from an alert generated externally and uploaded via the {% data variables.product.prodname_code_scanning %} API.
68-
69-
If you use multiple configurations to analyze a file, any problems detected by the same query are reported as alerts with multiple analysis origins. If an alert has more than one analysis origin, a {% octicon "workflow" aria-label="The workflow icon" %} icon will appear next to any relevant branch in the **Affected branches** section on the right-hand side of the alert page. You can hover over the {% octicon "workflow" aria-label="The workflow icon" %} icon to see the names of each analysis origin and the status of the alert for that analysis origin. You can also view the history of when alerts appeared in each analysis origin in the timeline on the alert page. If an alert only has one analysis origin, no information about analysis origins is displayed on the alert page.
70-
71-
![Screenshot showing a code scanning alert with multiple analysis origins.](/assets/images/help/repository/code-scanning-analysis-origins.png)
72-
73-
{% note %}
74-
75-
**Note:** Sometimes a {% data variables.product.prodname_code_scanning %} alert displays as fixed for one analysis origin but is still open for a second analysis origin. You can resolve this by re-running the second {% data variables.product.prodname_code_scanning %} configuration to update the alert status for that analysis origin.
76-
77-
{% endnote %}
78-
{% endif %}
7965

8066
### About labels for alerts that are not found in application code
8167

Diff for: content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md

+2-8
Original file line numberDiff line numberDiff line change
@@ -166,11 +166,9 @@ Alerts may be fixed in one branch but not in another. You can use the "Branch" f
166166
{% note %}
167167

168168
**Note:**
169-
{%- ifversion remove-code-scanning-configurations %}
169+
170170
If you run {% data variables.product.prodname_code_scanning %} using multiple configurations, the same alert will sometimes be generated by more than one configuration. Unless you run all configurations regularly, you may see alerts that are fixed in one configuration but not in another. These stale configurations and alerts can be removed from a branch. For more information, see "[Removing stale configurations and alerts from a branch](#removing-stale-configurations-and-alerts-from-a-branch)."
171-
{% else %}
172-
If you run {% data variables.product.prodname_code_scanning %} using multiple configurations, then sometimes an alert will have multiple analysis origins. Unless you run all configurations regularly, you may see alerts that are fixed in one analysis origin but not in another. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-analysis-origins)."
173-
{% endif %}
171+
174172
{% endnote %}
175173

176174
## Dismissing alerts
@@ -213,8 +211,6 @@ If a project has multiple alerts that you want to dismiss for the same reason, y
213211

214212
If you dismiss an alert but later realize that you need to fix the alert, you can re-open it and fix the problem with the code. Display the list of closed alerts, find the alert, display it, and reopen it. You can then fix the alert in the same way as any other alert.
215213

216-
{% ifversion remove-code-scanning-configurations %}
217-
218214
## Removing stale configurations and alerts from a branch
219215

220216
You may have multiple code scanning configurations on a single repository. When run, multiple configurations can generate the same alert. Additionally, if the configurations are run on different schedules, the alert statuses may become out-of-date for infrequent or stale configurations. For more information on alerts from multiple configurations, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alerts-from-multiple-configurations)."
@@ -242,8 +238,6 @@ You may have multiple code scanning configurations on a single repository. When
242238

243239
{% endnote %}
244240

245-
{% endif %}
246-
247241
## Auditing responses to {% data variables.product.prodname_code_scanning %} alerts
248242

249243
{% data reusables.code-scanning.audit-code-scanning-events %}

Diff for: content/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs.md

-4
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,8 @@ For information about the {% data variables.product.prodname_codeql_cli %}, see
4343

4444
{% data reusables.code-scanning.extractor-diagnostics %}
4545

46-
{% ifversion codeql-action-debug-logging %}
47-
4846
You can see more detailed information about {% data variables.product.prodname_codeql %} extractor errors and warnings that occurred during database creation by enabling debug logging. For more information, see "[AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/logs-are-not-detailed-enough#creating-codeql-debugging-artifacts-by-re-running-jobs-with-debug-logging-enabled)."
4947

50-
{% endif %}
51-
5248
## Viewing the logging output from {% data variables.product.prodname_code_scanning %}
5349

5450
This section applies to {% data variables.product.prodname_code_scanning %} run using {% data variables.product.prodname_actions %} ({% data variables.product.prodname_codeql %} or third-party).

Diff for: content/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough.md

-4
Original file line numberDiff line numberDiff line change
@@ -24,16 +24,12 @@ The debug artifacts will be uploaded to the workflow run as an artifact named `d
2424

2525
These artifacts will help you debug problems with {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}. If you contact GitHub support, they might ask for this data.
2626

27-
{% ifversion codeql-action-debug-logging %}
28-
2927
### Creating {% data variables.product.prodname_codeql %} debugging artifacts by re-running jobs with debug logging enabled
3028

3129
You can create {% data variables.product.prodname_codeql %} debugging artifacts by enabling debug logging and re-running the jobs. For more information about re-running {% data variables.product.prodname_actions %} workflows and jobs, see "[AUTOTITLE](/actions/managing-workflow-runs/re-running-workflows-and-jobs)."
3230

3331
You need to ensure that you select **Enable debug logging**. This option enables runner diagnostic logging and step debug logging for the run. You'll then be able to download `debug-artifacts` to investigate further. You do not need to modify the workflow file when creating {% data variables.product.prodname_codeql %} debugging artifacts by re-running jobs.
3432

35-
{% endif %}
36-
3733
### Creating {% data variables.product.prodname_codeql %} debugging artifacts using a workflow flag
3834

3935
You can create {% data variables.product.prodname_codeql %} debugging artifacts by using a flag in your workflow. For this, you need to modify the `init` step of your {% data variables.code-scanning.codeql_workflow %} file and set `debug: true`.

Diff for: content/code-security/code-scanning/troubleshooting-code-scanning/results-different-than-expected.md

-2
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,4 @@ To check if default setup is enabled, navigate to the main page of the repositor
1717

1818
If you want to return to using advanced setup and get {% data variables.product.prodname_code_scanning %} results from your custom workflow file, click {% octicon "stop" aria-hidden="true" %} **Disable {% data variables.product.prodname_codeql %}** to disable default setup. Then you should re-enable your pre-existing workflows to start triggering and uploading results from advanced setup. For more information, see "[AUTOTITLE](/actions/managing-workflow-runs/disabling-and-enabling-a-workflow)" and "[AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning)."
1919

20-
{% ifversion remove-code-scanning-configurations %}
2120
{% data reusables.code-scanning.troubleshooting-multiple-configurations %}
22-
{% endif %}

0 commit comments

Comments
 (0)