You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.md
+3-17
Original file line number
Diff line number
Diff line change
@@ -296,8 +296,6 @@ In this example, the default queries will be run for Java, as well as the querie
296
296
297
297
{% data reusables.code-scanning.run-additional-queries %}
298
298
299
-
{% ifversion codeql-packs %}
300
-
301
299
### Using query packs
302
300
303
301
To add one or more {% data variables.product.prodname_codeql %} query packs, add a `with: packs:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. Within `packs` you specify one or more packages to use and, optionally, which version to download. Where you don't specify a version, the latest version is downloaded. If you want to use packages that are not publicly available, you need to set the `GITHUB_TOKEN` environment variable to a secret that has access to the packages. For more information, see "[AUTOTITLE](/actions/security-guides/automatic-token-authentication)" and "[AUTOTITLE](/actions/security-guides/encrypted-secrets)."
@@ -321,7 +319,6 @@ In the example below, `scope` is the organization or personal account that publi
**Note:** If you specify a particular version of a query pack to use,
@@ -334,7 +331,6 @@ To ensure optimal performance, if you need to specify exact query pack versions,
334
331
For more information about pack compatibility, see "[AUTOTITLE](/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs#about-codeql-pack-compatibility)."
335
332
336
333
{% endnote %}
337
-
{% endif %}
338
334
339
335
### Downloading {% data variables.product.prodname_codeql %} packs from {% data variables.product.prodname_ghe_server %}
340
336
@@ -370,7 +366,6 @@ Notice the `|` after the `registries` property name. This is important since {%
370
366
371
367
### Using queries in QL packs
372
368
373
-
{% endif %}
374
369
To add one or more queries, add a `with: queries:` entry within the `uses: {% data reusables.actions.action-codeql-action-init %}` section of the workflow. If the queries are in a private repository, use the `external-repository-token` parameter to specify a token that has access to checkout the private repository.
375
370
376
371
You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language.
@@ -388,24 +383,18 @@ You can also specify query suites in the value of `queries`. Query suites are co
388
383
389
384
{% data reusables.code-scanning.codeql-query-suites-explanation %}
390
385
391
-
{% ifversion codeql-packs %}
392
-
393
386
### Working with custom configuration files
394
387
395
-
{% endif %}
396
-
397
-
If you also use a configuration file for custom settings, any additional {% ifversion codeql-packs %}packs or {% endif %}queries specified in your workflow are used instead of those specified in the configuration file. If you want to run the combined set of additional {% ifversion codeql-packs %}packs or {% endif %}queries, prefix the value of {% ifversion codeql-packs %}`packs` or {% endif %}`queries` in the workflow with the `+` symbol. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)."
388
+
If you also use a configuration file for custom settings, any additional packs or queries specified in your workflow are used instead of those specified in the configuration file. If you want to run the combined set of additional packs or queries, prefix the value of `packs` or `queries` in the workflow with the `+` symbol. For more information, see "[Using a custom configuration file](#using-a-custom-configuration-file)."
398
389
399
-
In the following example, the `+` symbol ensures that the specified additional {% ifversion codeql-packs %}packs and {% endif %}queries are used together with any specified in the referenced configuration file.
390
+
In the following example, the `+` symbol ensures that the specified additional packs and queries are used together with any specified in the referenced configuration file.
400
391
401
392
``` yaml copy
402
393
- uses: {% data reusables.actions.action-codeql-action-init %}
<!-- Anchor to maintain the current CodeQL CLI manual pages link: https://aka.ms/code-scanning-docs/config-file -->
411
400
<a name="using-a-custom-configuration-file"></a>
@@ -415,7 +404,7 @@ In the following example, the `+` symbol ensures that the specified additional {
415
404
416
405
## Using a custom configuration file
417
406
418
-
A custom configuration file is an alternative way to specify additional {% ifversion codeql-packs %}packs and {% endif %}queries to run. You can also use the file to disable the default queries{% ifversion code-scanning-exclude-queries-from-analysis %}, exclude or include specific queries,{% endif %} and to specify which directories to scan during analysis.
407
+
A custom configuration file is an alternative way to specify additional packs and queries to run. You can also use the file to disable the default queries{% ifversion code-scanning-exclude-queries-from-analysis %}, exclude or include specific queries,{% endif %} and to specify which directories to scan during analysis.
419
408
420
409
In the workflow file, use the `config-file` parameter of the `init` action to specify the path to the configuration file you want to use. This example loads the configuration file _./.github/codeql/codeql-config.yml_.
421
410
@@ -437,8 +426,6 @@ If the configuration file is located in an external private repository, use the
437
426
438
427
The settings in the configuration file are written in YAML format.
439
428
440
-
{% ifversion codeql-packs %}
441
-
442
429
### Specifying {% data variables.product.prodname_codeql %} query packs
443
430
444
431
You specify {% data variables.product.prodname_codeql %} query packs in an array. Note that the format is different from the format used by the workflow file.
Copy file name to clipboardExpand all lines: content/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts.md
+1-15
Original file line number
Diff line number
Diff line change
@@ -55,27 +55,13 @@ If you configure {% data variables.product.prodname_code_scanning %} using {% da
55
55
56
56
When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_caps %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.
57
57
58
-
### About {% ifversion remove-code-scanning-configurations %}alerts from multiple configurations{% else %}analysis origins{% endif %}
You can run multiple configurations of code analysis on a repository, using different tools and targeting different languages or areas of the code. Each configuration of {% data variables.product.prodname_code_scanning %} generates a unique set of alerts. For example, an alert generated using the default {% data variables.product.prodname_codeql %} analysis with {% data variables.product.prodname_actions %} comes from a different configuration than an alert generated externally and uploaded via the {% data variables.product.prodname_code_scanning %} API.
62
61
63
62
If you use multiple configurations to analyze a file, any problems detected by the same query are reported as alerts generated by multiple configurations. If an alert exists in more than one configuration, the number of configurations appears next to the branch name in the "Affected branches" section on the right-hand side of the alert page. To view the configurations for an alert, in the "Affected branches" section, click a branch. A "Configurations analyzing" modal appears with the names of each configuration generating the alert for that branch. Below each configuration, you can see when that configuration's alert was last updated.
64
63
65
64
An alert may display different statuses from different configurations. To update the alert statuses, re-run each out-of-date configuration. Alternatively, you can delete stale configurations from a branch to remove outdated alerts. For more information on deleting stale configurations and alerts, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository#removing-stale-configurations-and-alerts-from-a-branch)."
66
-
{% else %}
67
-
You can run multiple configurations of code analysis on a repository, using different tools and targeting different languages or areas of the code. Each configuration of {% data variables.product.prodname_code_scanning %} is the analysis origin for all the alerts it generates. For example, an alert generated using the default {% data variables.product.prodname_codeql %} analysis with {% data variables.product.prodname_actions %} will have a different analysis origin from an alert generated externally and uploaded via the {% data variables.product.prodname_code_scanning %} API.
68
-
69
-
If you use multiple configurations to analyze a file, any problems detected by the same query are reported as alerts with multiple analysis origins. If an alert has more than one analysis origin, a {% octicon "workflow" aria-label="The workflow icon" %} icon will appear next to any relevant branch in the **Affected branches** section on the right-hand side of the alert page. You can hover over the {% octicon "workflow" aria-label="The workflow icon" %} icon to see the names of each analysis origin and the status of the alert for that analysis origin. You can also view the history of when alerts appeared in each analysis origin in the timeline on the alert page. If an alert only has one analysis origin, no information about analysis origins is displayed on the alert page.
70
-
71
-

72
-
73
-
{% note %}
74
-
75
-
**Note:** Sometimes a {% data variables.product.prodname_code_scanning %} alert displays as fixed for one analysis origin but is still open for a second analysis origin. You can resolve this by re-running the second {% data variables.product.prodname_code_scanning %} configuration to update the alert status for that analysis origin.
76
-
77
-
{% endnote %}
78
-
{% endif %}
79
65
80
66
### About labels for alerts that are not found in application code
Copy file name to clipboardExpand all lines: content/code-security/code-scanning/managing-code-scanning-alerts/managing-code-scanning-alerts-for-your-repository.md
+2-8
Original file line number
Diff line number
Diff line change
@@ -166,11 +166,9 @@ Alerts may be fixed in one branch but not in another. You can use the "Branch" f
If you run {% data variables.product.prodname_code_scanning %} using multiple configurations, the same alert will sometimes be generated by more than one configuration. Unless you run all configurations regularly, you may see alerts that are fixed in one configuration but not in another. These stale configurations and alerts can be removed from a branch. For more information, see "[Removing stale configurations and alerts from a branch](#removing-stale-configurations-and-alerts-from-a-branch)."
171
-
{% else %}
172
-
If you run {% data variables.product.prodname_code_scanning %} using multiple configurations, then sometimes an alert will have multiple analysis origins. Unless you run all configurations regularly, you may see alerts that are fixed in one analysis origin but not in another. For more information, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-analysis-origins)."
173
-
{% endif %}
171
+
174
172
{% endnote %}
175
173
176
174
## Dismissing alerts
@@ -213,8 +211,6 @@ If a project has multiple alerts that you want to dismiss for the same reason, y
213
211
214
212
If you dismiss an alert but later realize that you need to fix the alert, you can re-open it and fix the problem with the code. Display the list of closed alerts, find the alert, display it, and reopen it. You can then fix the alert in the same way as any other alert.
## Removing stale configurations and alerts from a branch
219
215
220
216
You may have multiple code scanning configurations on a single repository. When run, multiple configurations can generate the same alert. Additionally, if the configurations are run on different schedules, the alert statuses may become out-of-date for infrequent or stale configurations. For more information on alerts from multiple configurations, see "[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alerts-from-multiple-configurations)."
@@ -242,8 +238,6 @@ You may have multiple code scanning configurations on a single repository. When
242
238
243
239
{% endnote %}
244
240
245
-
{% endif %}
246
-
247
241
## Auditing responses to {% data variables.product.prodname_code_scanning %} alerts
248
242
249
243
{% data reusables.code-scanning.audit-code-scanning-events %}
Copy file name to clipboardExpand all lines: content/code-security/code-scanning/managing-your-code-scanning-configuration/viewing-code-scanning-logs.md
-4
Original file line number
Diff line number
Diff line change
@@ -43,12 +43,8 @@ For information about the {% data variables.product.prodname_codeql_cli %}, see
43
43
44
44
{% data reusables.code-scanning.extractor-diagnostics %}
45
45
46
-
{% ifversion codeql-action-debug-logging %}
47
-
48
46
You can see more detailed information about {% data variables.product.prodname_codeql %} extractor errors and warnings that occurred during database creation by enabling debug logging. For more information, see "[AUTOTITLE](/code-security/code-scanning/troubleshooting-code-scanning/logs-are-not-detailed-enough#creating-codeql-debugging-artifacts-by-re-running-jobs-with-debug-logging-enabled)."
49
47
50
-
{% endif %}
51
-
52
48
## Viewing the logging output from {% data variables.product.prodname_code_scanning %}
53
49
54
50
This section applies to {% data variables.product.prodname_code_scanning %} run using {% data variables.product.prodname_actions %} ({% data variables.product.prodname_codeql %} or third-party).
Copy file name to clipboardExpand all lines: content/code-security/code-scanning/troubleshooting-code-scanning/logs-not-detailed-enough.md
-4
Original file line number
Diff line number
Diff line change
@@ -24,16 +24,12 @@ The debug artifacts will be uploaded to the workflow run as an artifact named `d
24
24
25
25
These artifacts will help you debug problems with {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}. If you contact GitHub support, they might ask for this data.
26
26
27
-
{% ifversion codeql-action-debug-logging %}
28
-
29
27
### Creating {% data variables.product.prodname_codeql %} debugging artifacts by re-running jobs with debug logging enabled
30
28
31
29
You can create {% data variables.product.prodname_codeql %} debugging artifacts by enabling debug logging and re-running the jobs. For more information about re-running {% data variables.product.prodname_actions %} workflows and jobs, see "[AUTOTITLE](/actions/managing-workflow-runs/re-running-workflows-and-jobs)."
32
30
33
31
You need to ensure that you select **Enable debug logging**. This option enables runner diagnostic logging and step debug logging for the run. You'll then be able to download `debug-artifacts` to investigate further. You do not need to modify the workflow file when creating {% data variables.product.prodname_codeql %} debugging artifacts by re-running jobs.
34
32
35
-
{% endif %}
36
-
37
33
### Creating {% data variables.product.prodname_codeql %} debugging artifacts using a workflow flag
38
34
39
35
You can create {% data variables.product.prodname_codeql %} debugging artifacts by using a flag in your workflow. For this, you need to modify the `init` step of your {% data variables.code-scanning.codeql_workflow %} file and set `debug: true`.
Copy file name to clipboardExpand all lines: content/code-security/code-scanning/troubleshooting-code-scanning/results-different-than-expected.md
-2
Original file line number
Diff line number
Diff line change
@@ -17,6 +17,4 @@ To check if default setup is enabled, navigate to the main page of the repositor
17
17
18
18
If you want to return to using advanced setup and get {% data variables.product.prodname_code_scanning %} results from your custom workflow file, click {% octicon "stop" aria-hidden="true" %} **Disable {% data variables.product.prodname_codeql %}** to disable default setup. Then you should re-enable your pre-existing workflows to start triggering and uploading results from advanced setup. For more information, see "[AUTOTITLE](/actions/managing-workflow-runs/disabling-and-enabling-a-workflow)" and "[AUTOTITLE](/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning)."
0 commit comments