Skip to content

Commit a834a0a

Browse files
aegilopsaegilops
authored
Merge pull request #41 from advanced-security/paths-ignore
Add default paths to ignore for various languages in build matrix
2 parents 6f97847 + 08b5670 commit a834a0a

File tree

2 files changed

+170
-5
lines changed

2 files changed

+170
-5
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ If you pass a global `queries` input, as a comma separated list of strings, it a
164164

165165
Similarly, you can pass in a global `config` or `config-file` input, which use the same format as [documented here](https://docs.github.com/en/enterprise-cloud@latest/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-a-custom-configuration-file) and [here](https://docs.github.com/en/enterprise-cloud@latest/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-configuration-details-using-the-config-input). This _cannot_ currently be set at the language or project level, only globally.
166166

167-
The effective config used is a combination of the inputs created from the paths of the project, and any queries set in the separate `queries` input to this Action, overlaid with the content of the `config` or `config-file` inputs.
167+
The effective config used is a combination of the inputs created from the `paths` of the project, and any queries set in the separate `queries` input to this Action, overlaid with the content of the `config` or `config-file` inputs. The `paths-ignore` will be used if passed in from the config input, otherwise a set of opinionated predetermined paths to ignore will be applied.
168168

169169
### Whole repo scanning
170170

‎changes/build-matrix.js‎

Lines changed: 169 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,163 @@ function run(github, context, core) {
77
const allowed_build_modes = new Set(["auto", "none", "manual", "other"]);
88
const other_err = 'setting as "other", which requires a fully manual scan with no automatic CodeQL analysis';
99

10+
// Note: The CodeQL config filter pattern characters ?, +, [, ], ! are not supported and will be matched literal
11+
// After extensive testing against JS in April 2015 - I would AVOID {} and [] globs as they are extremely limited support
12+
const pathIgnoreDefaults = {
13+
"javascript-typescript": [
14+
"**/node_modules/**",
15+
"**/bower_components/**",
16+
"**/*.min.js",
17+
"**/*-min.js",
18+
"**/*.test.js",
19+
"**/*.test.ts",
20+
"**/*.test.jsx",
21+
"**/*.test.tsx",
22+
"**/*.spec.js",
23+
"**/*.spec.ts",
24+
"**/*.spec.jsx",
25+
"**/*.spec.tsx",
26+
"**/tests/**",
27+
"**/jest.config.*",
28+
"**/jest.setup.*",
29+
"**/test-utils/**",
30+
"**/coverage/**",
31+
"**/CoverageResults/**",
32+
"**/dist/**",
33+
"**/3rd-party*/**",
34+
"**/3rd_party*/**",
35+
"**/third-party*/**",
36+
"**/third_party*/**",
37+
"**/3rd-Party*/**",
38+
"**/3rd_Party*/**",
39+
"**/Third-Party*/**",
40+
"**/Third_Party*/**",
41+
"**/vendor/**",
42+
"**/.next/**",
43+
"**/storybook-static/**",
44+
"**/__tests__/**",
45+
"**/__mocks__/**",
46+
"**/cypress/**",
47+
],
48+
"java-kotlin": [
49+
"**/target/**",
50+
"**/build/**",
51+
"**/out/**",
52+
"**/test/**",
53+
"**/.gradle/**",
54+
"**/3rd-party*/**",
55+
"**/3rd_party*/**",
56+
"**/third-party*/**",
57+
"**/third_party*/**",
58+
"**/3rd-Party*/**",
59+
"**/3rd_Party*/**",
60+
"**/Third-Party*/**",
61+
"**/Third_Party*/**",
62+
"**/vendor/**",
63+
"**/generated/**",
64+
"**/lib/**",
65+
"**/libs/**",
66+
"**/*Test.java",
67+
"**/*Test.kt",
68+
"**/*Tests.java",
69+
"**/*Tests.kt",
70+
"**/jacoco/**",
71+
"**/surefire-reports/**",
72+
],
73+
"python": [
74+
"**/venv/**",
75+
"**/__pycache__/**",
76+
"**/test/**",
77+
"**/tests/**",
78+
"**/*.pyc",
79+
"**/.tox/**",
80+
"**/.pytest_cache/**",
81+
"**/.coverage/**",
82+
"**/htmlcov/**",
83+
"**/3rd-party*/**",
84+
"**/3rd_party*/**",
85+
"**/third-party*/**",
86+
"**/third_party*/**",
87+
"**/3rd-Party*/**",
88+
"**/3rd_Party*/**",
89+
"**/Third-Party*/**",
90+
"**/Third_Party*/**",
91+
"**/vendor/**",
92+
"**/.eggs/**",
93+
"**/egg-info/**",
94+
"**/dist/**",
95+
"**/build/lib/**",
96+
"**/*_test.py",
97+
"**/conftest.py",
98+
],
99+
"csharp": [
100+
"**/bin/**",
101+
"**/obj/**",
102+
"**/test/**",
103+
"**/tests/**",
104+
"**/wwwroot/lib/**",
105+
"**/CoverageResults/**",
106+
"**/TestResults/**",
107+
"**/3rd-party*/**",
108+
"**/3rd_party*/**",
109+
"**/third-party*/**",
110+
"**/third_party*/**",
111+
"**/3rd-Party*/**",
112+
"**/3rd_Party*/**",
113+
"**/Third-Party*/**",
114+
"**/Third_Party*/**",
115+
"**/vendor/**",
116+
"**/*.test.cs",
117+
"**/*.tests.cs",
118+
"**/*.Test.cs",
119+
"**/*.Tests.cs",
120+
"**/*Test.cs",
121+
"**/*Tests.cs",
122+
"**/packages/**",
123+
"**/_ReSharper*/**",
124+
"**/artifacts/**",
125+
"**/.vs/**",
126+
],
127+
"ruby": [
128+
"**/vendor/**",
129+
"**/test/**",
130+
"**/spec/**",
131+
"**/3rd-party*/**",
132+
"**/3rd_party*/**",
133+
"**/third-party*/**",
134+
"**/third_party*/**",
135+
"**/3rd-Party*/**",
136+
"**/3rd_Party*/**",
137+
"**/Third-Party*/**",
138+
"**/Third_Party*/**",
139+
"**/bundle/**",
140+
"**/coverage/**",
141+
"**/.bundle/**",
142+
"**/tmp/**",
143+
"**/log/**",
144+
"**/db/migrate/**",
145+
],
146+
"c-cpp": [
147+
"**/build/**",
148+
"**/test/**",
149+
"**/tests/**",
150+
"**/*_test.c",
151+
"**/*_test.cpp",
152+
"**/*_test.cc",
153+
"**/*_test.h",
154+
// Unclear if CPP build mode none would prefer to have these
155+
// "**/tmp/**",
156+
// "**/{3rd,Third,third}{_,-}{Party,party}*/**",
157+
// "**/vendor/**",
158+
// "**/deps/**",
159+
// "**/external/**",
160+
// "**/lib/**",
161+
// "**/libs/**",
162+
// "**/unity/**",
163+
// "**/googletest/**",
164+
],
165+
};
166+
10167
const top_level_files = {
11168
"java-kotlin": [
12169
"pom.xml",
@@ -47,7 +204,7 @@ function run(github, context, core) {
47204
c: "c-cpp",
48205
"c++": "c-cpp",
49206
cpp: "c-cpp",
50-
"c#": "csharp",
207+
"c#": "csharp",
51208
java: "java-kotlin",
52209
kotlin: "java-kotlin",
53210
typescript: "javascript-typescript",
@@ -96,7 +253,7 @@ function run(github, context, core) {
96253
const language = resolveLanguageAlias(languageKey);
97254
core.debug("Resolved Language: " + language);
98255
core.debug("Projects: " + JSON.stringify(lang_data.projects));
99-
256+
100257
projects_to_scan[language] = {};
101258

102259
projects_to_scan[language]["projects"] = Object.fromEntries(
@@ -166,10 +323,18 @@ function run(github, context, core) {
166323
paths: Array.from(project_paths)
167324
});
168325

326+
// Apply paths-ignore: use existing if available, otherwise use defaults for the language
327+
if (!project_config["paths-ignore"] && pathIgnoreDefaults[language]) {
328+
// The yaml library will handle the quoting, but we need to make sure the strings are preserved as is
329+
project_config["paths-ignore"] = pathIgnoreDefaults[language];
330+
} else if (build_mode === "none" && !project_config["paths-ignore"] && !pathIgnoreDefaults[language]) {
331+
core.warning(`${language} with build-mode: none, paths-ignore filters are recommended here to ignore test/vendored dependencies!`);
332+
}
333+
169334
if (project_queries !== null && project_queries.size > 0) {
170-
project_config.queries = Array.from(project_queries).map((query) => { return {uses: query} })
335+
project_config.queries = Array.from(project_queries).map((query) => { return { uses: query } })
171336
}
172-
337+
173338
const codeql_config_yaml = yaml.stringify(project_config);
174339

175340
const sparse_checkout_str = Array.from(project_paths).join("\n");

0 commit comments

Comments
 (0)