Skip to content

Commit c096afd

Browse files
camihmerharcamihmerhar
authored
Initial commit
0 parents commit c096afd

File tree

13 files changed

+434
-0
lines changed

13 files changed

+434
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "monthly"

‎.github/steps/-step.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
0

‎.github/steps/0-welcome.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<!-- readme -->

‎.github/steps/1-codeql-language-matrix.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
## Step 1: Add a language matrix to your CodeQL workflow file
2+
3+
_Welcome to "Configuring a CodeQL language matrix"! :wave:_
4+
5+
## CodeQL language matrices
6+
7+
CodeQL language matrices allow you to configure your CodeQL workflows with a language matrix to simplify your code scanning workflows. This allows you to have a single code scanning workflow that covers all the languages in your repository.
8+
9+
### Importance of using languages matrices with code scanning
10+
11+
1. **Simplicity**: Using a language matrix with CodeQL simplifies your workflow by allowing you to manage multiple languages in a single workflow file. This eliminates the need for separate workflows for each language, making your code scanning process more streamlined and manageable.
12+
2. **Flexibility**: A language matrix provides flexibility as it allows you to easily add or remove languages from your workflow. This means you can quickly adapt your code scanning process to changes in your project's language usage.
13+
3. **Consistency**: By using a language matrix, you ensure consistent code scanning across all languages used in your project. This helps maintain the quality and security of your codebase, regardless of the language it's written in.
14+
15+
Remember, a well-configured CodeQL setup is key to maintaining a secure and reliable codebase.
16+
17+
### :keyboard: Activity: Configure your `codeql.yml` file to use a language matrix
18+
19+
1. Navigate to the `Code` tab and locate the `.github/workflows` folder.
20+
1. Add the following content to the `codeql.yml` file before the steps section:
21+
```yaml
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
language: [ 'go', 'java-kotlin', 'javascript-typescript', 'python' ]
26+
# CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
27+
# Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
28+
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
29+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
30+
31+
```
32+
1. Ensure that your indentation is correct after adding the strategy section.
33+
1. Now that you have added the strategy, you need to update CodeQL to actually use the language matrix. Add the following to the CodeQL init action:
34+
```yaml
35+
with:
36+
languages: ${{ matrix.language }}
37+
```
38+
1. Finally we need to add the language matrix to the CodeQL analyze action. Add the following to the CodeQL analyze action:
39+
```yaml
40+
with:
41+
category: ${{ matrix.language }}
42+
```
43+
1. Commit the changes directly to the `main` branch.
44+
1. Wait about 20 seconds then refresh this page (the one you're following instructions from). [GitHub Actions](https://docs.github.com/en/actions) will automatically update to the next step.

‎.github/steps/2-codeql-autobuild.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
## Step 2: Have autobuild run only when needed
2+
3+
_Nice work! :tada: You modified your workflow to use a language matrix!_
4+
5+
With the language matrix specified we can see the languages that we want to scan. One of those languages is a compiled language, and as such will not work correctly with how we have the workflow set up. We need to make sure that the autobuild step is included _and_ only runs when it is needed.
6+
7+
Autobuild for CodeQL is a feature that automatically attempts to build any compiled languages in your repository. It works by detecting the build system in your repository and executing the appropriate commands to compile the code, enabling CodeQL to analyze the compiled language.
8+
9+
Let's try this out with our existing CodeQL workflow file.
10+
11+
### :keyboard: Activity: Configure the workflow to use autobuild for the `java-kotlin` language
12+
13+
1. Navigate to the `.github/workflows` directory in your repository.
14+
1. Open the `codeql.yml` file.
15+
1. Add the autobuild step to the file in between the `Initialize CodeQL` and `Perform CodeQL Analysis` steps:
16+
```yaml
17+
- name: Autobuild
18+
uses: github/codeql-action/autobuild@v3
19+
```
20+
1. Ensure that your indentation is correct after adding the step.
21+
1. Now we need to make sure that the autobuild step only runs when it is needed. Add to the `Autobuild` step a conditional expression that checks to make sure the language is `java-kotlin`.
22+
23+
<details>
24+
<summary>Autobuild step after adding conditional</summary>
25+
26+
```yaml
27+
- if: ${{ contains(matrix.language, 'java-kotlin') }}
28+
name: Autobuild
29+
uses: github/codeql-action/autobuild@v3
30+
```
31+
32+
</details>
33+
34+
1. Commit the changes directly to the `main` branch.
35+
1. Wait about 20 seconds then refresh this page (the one you're following instructions from). [GitHub Actions](https://docs.github.com/en/actions) will automatically update to the next step.

‎.github/steps/X-finish.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
## Finish
2+
3+
_Congratulations friend, you've completed this course!_
4+
5+
<img src="https://octodex.github.com/images/welcometocat.png" alt=celebrate width=300 align=right>
6+
7+
Here's a recap of all the tasks you've accomplished in your repository:
8+
9+
- You've learned how to use a language matrix with CodeQL workflows.
10+
- You've learned how about the CodeQL autobuild action works.
11+
- You've learned how to use contextual expressions.
12+
13+
### Additional learning and resources
14+
15+
- [Configuring code scanning](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning)
16+
17+
### What's next?
18+
19+
- Learn more about autobuild for compiled languages: [CodeQL code scanning for compiled languages](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages).
20+
- [We'd love to hear what you thought of this course](https://github.com/skills/.github/discussions).
21+
- [Learn another GitHub skill](https://github.com/skills).
22+
- [Read the Get started with GitHub docs](https://docs.github.com/en/get-started).
23+
- To find projects to contribute to, check out [GitHub Explore](https://github.com/explore).

‎.github/workflows/0-welcome.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Step 0, Welcome
2+
3+
# This step triggers after the learner creates a new repository from the template.
4+
# This workflow updates from step 0 to step 1.
5+
6+
# This will run every time we create push a commit to `main`.
7+
# Reference: https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
8+
on:
9+
create:
10+
workflow_dispatch:
11+
12+
# Reference: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
13+
permissions:
14+
# Need `contents: read` to checkout the repository.
15+
# Need `contents: write` to update the step metadata.
16+
contents: write
17+
18+
jobs:
19+
# Get the current step to only run the main job when the learner is on the same step.
20+
get_current_step:
21+
name: Check current step number
22+
runs-on: ubuntu-latest
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
- id: get_step
27+
run: |
28+
echo "current_step=$(cat ./.github/steps/-step.txt)" >> $GITHUB_OUTPUT
29+
outputs:
30+
current_step: ${{ steps.get_step.outputs.current_step }}
31+
32+
on_start:
33+
name: On start
34+
needs: get_current_step
35+
36+
# We will only run this action when:
37+
# 1. This repository isn't the template repository.
38+
# 2. The step is currently 0.
39+
# Reference: https://docs.github.com/en/actions/learn-github-actions/contexts
40+
# Reference: https://docs.github.com/en/actions/learn-github-actions/expressions
41+
if: >-
42+
${{ !github.event.repository.is_template
43+
&& needs.get_current_step.outputs.current_step == 0 }}
44+
45+
# We'll run Ubuntu for performance instead of Mac or Windows.
46+
runs-on: ubuntu-latest
47+
48+
steps:
49+
# We'll need to check out the repository so that we can edit the README.
50+
- name: Checkout
51+
uses: actions/checkout@v4
52+
with:
53+
fetch-depth: 0 # Let's get all the branches.
54+
55+
# In README.md, switch step 0 for step 1.
56+
- name: Update to step 1
57+
uses: skills/action-update-step@v2
58+
with:
59+
token: ${{ secrets.GITHUB_TOKEN }}
60+
from_step: 0
61+
to_step: 1

‎.github/workflows/1-codeql-language-matrix.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Step 1, Add a language matrix to your CodeQL workflow file
2+
3+
# This step triggers after push to codeql.yml.
4+
# This workflow updates from step 1 to step 2.
5+
6+
# This will run every time we push to main.
7+
# Reference: https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
8+
on:
9+
workflow_dispatch:
10+
push:
11+
branches:
12+
- main
13+
paths:
14+
- ".github/workflows/codeql.yml"
15+
16+
# Reference: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
17+
permissions:
18+
# Need `contents: read` to checkout the repository.
19+
# Need `contents: write` to update the step metadata.
20+
contents: write
21+
22+
jobs:
23+
# Get the current step to only run the main job when the learner is on the same step.
24+
get_current_step:
25+
name: Check current step number
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v4
30+
- id: get_step
31+
run: |
32+
echo "current_step=$(cat ./.github/steps/-step.txt)" >> $GITHUB_OUTPUT
33+
outputs:
34+
current_step: ${{ steps.get_step.outputs.current_step }}
35+
36+
on_add_strategy:
37+
name: On Add Strategy
38+
needs: get_current_step
39+
40+
# We will only run this action when:
41+
# 1. This repository isn't the template repository.
42+
# 2. The step is currently 0.
43+
# Reference: https://docs.github.com/en/actions/learn-github-actions/contexts
44+
# Reference: https://docs.github.com/en/actions/learn-github-actions/expressions
45+
if: >-
46+
${{ !github.event.repository.is_template
47+
&& needs.get_current_step.outputs.current_step == 1 }}
48+
49+
# We'll run Ubuntu for performance instead of Mac or Windows.
50+
runs-on: ubuntu-latest
51+
52+
steps:
53+
# We'll need to check out the repository so that we can edit the README.
54+
- name: Checkout
55+
uses: actions/checkout@v4
56+
57+
# Verify the learner added the file contents.
58+
- name: Check workflow contents, jobs
59+
uses: skills/action-check-file@v1
60+
with:
61+
file: ".github/workflows/codeql.yml"
62+
search: "matrix:"
63+
64+
# Verify the learner added the file contents.
65+
- name: Check workflow contents, jobs
66+
uses: skills/action-check-file@v1
67+
with:
68+
file: ".github/workflows/codeql.yml"
69+
search: "languages:"
70+
71+
# Verify the learner added the file contents.
72+
- name: Check workflow contents, jobs
73+
uses: skills/action-check-file@v1
74+
with:
75+
file: ".github/workflows/codeql.yml"
76+
search: "category:"
77+
78+
# In README.md, switch step 1 for step 2.
79+
- name: Update to step 2
80+
uses: skills/action-update-step@v2
81+
with:
82+
token: ${{ secrets.GITHUB_TOKEN }}
83+
from_step: 1
84+
to_step: 2

‎.github/workflows/2-codeql-autobuild.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Step 2, Have autobuild run only when needed
2+
3+
# This step triggers after push to codeql.yml.
4+
# This step updates from step 2 to X.
5+
6+
# This will run every time we push to dependabot.yml.
7+
# Reference: https://docs.github.com/en/actions/learn-github-actions/events-that-trigger-workflows
8+
on:
9+
workflow_dispatch:
10+
push:
11+
branches:
12+
- main
13+
paths:
14+
- ".github/workflows/codeql.yml"
15+
16+
# Reference: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
17+
permissions:
18+
# Need `contents: read` to checkout the repository.
19+
# Need `contents: write` to update the step metadata.
20+
contents: write
21+
22+
jobs:
23+
# Get the current step to only run the main job when the learner is on the same step.
24+
get_current_step:
25+
name: Check current step number
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v4
30+
- id: get_step
31+
run: |
32+
echo "current_step=$(cat ./.github/steps/-step.txt)" >> $GITHUB_OUTPUT
33+
outputs:
34+
current_step: ${{ steps.get_step.outputs.current_step }}
35+
36+
on_add_autobuild:
37+
name: On Add Autobuild
38+
needs: get_current_step
39+
40+
# We will only run this action when:
41+
# 1. This repository isn't the template repository.
42+
# 2. The step is currently 2.
43+
# Reference: https://docs.github.com/en/actions/learn-github-actions/contexts
44+
# Reference: https://docs.github.com/en/actions/learn-github-actions/expressions
45+
if: >-
46+
${{ !github.event.repository.is_template
47+
&& needs.get_current_step.outputs.current_step == 2 }}
48+
49+
# We'll run Ubuntu for performance instead of Mac or Windows.
50+
runs-on: ubuntu-latest
51+
52+
steps:
53+
# We'll need to check out the repository so that we can edit the README.
54+
- name: Checkout
55+
uses: actions/checkout@v4
56+
with:
57+
fetch-depth: 0 # Let's get all the branches.
58+
59+
# Verify the learner added the file contents.
60+
- name: Check workflow contents, jobs
61+
uses: skills/action-check-file@v1
62+
with:
63+
file: ".github/workflows/codeql.yml"
64+
search: "contains\\(matrix\\.language, 'java-kotlin'\\)"
65+
66+
# In README.md, switch step 2 for step X.
67+
- name: Update to step X
68+
uses: skills/action-update-step@v2
69+
with:
70+
token: ${{ secrets.GITHUB_TOKEN }}
71+
from_step: 2
72+
to_step: X

‎.github/workflows/codeql.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: "Code Scanning - Action"
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
7+
jobs:
8+
CodeQL-Build:
9+
runs-on: ubuntu-latest
10+
11+
permissions:
12+
# required for all workflows
13+
security-events: write
14+
actions: read
15+
contents: read
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v4
20+
21+
- name: Initialize CodeQL
22+
uses: github/codeql-action/init@v3
23+
24+
- name: Perform CodeQL Analysis
25+
uses: github/codeql-action/analyze@v3

0 commit comments

Comments
 (0)