@@ -69,80 +69,80 @@ jobs:
6969 run : |
7070 ./scripts/run-tests.sh "ql/test/${{ matrix.test-folders }}"
7171
72- scanning :
73- runs-on : ubuntu-latest
74- needs : [tests]
75-
76- strategy :
77- matrix :
78- # project: ["hashicorp/terraform-guides", "akamai/terraform-examples", "aws-samples/aws-sam-terraform-examples"]
79- project : []
80-
81- steps :
82- - name : " Checkout"
83- uses : actions/checkout@v5
84- with :
85- submodules : true
86-
87- - name : " Checkout"
88- uses : actions/checkout@v5
89- with :
90- repository : ${{ matrix.project }}
91- path : project
92-
93- - name : " Check for changes"
94- uses : dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
95- id : extractor-changes
96- with :
97- filters : |
98- src:
99- - 'extractor/**'
100- - 'rust-toolchain.toml'
101- - 'Cargo.*'
102-
103- - name : " Download Extracter"
104- if : steps.extractor-changes.outputs.src == 'false'
105- env :
106- GH_TOKEN : ${{ github.token }}
107- run : |
108- set -e
109- gh release list -L 1 -R "advanced-security/codeql-extractor-iac"
110-
111- gh release download \
112- -R "advanced-security/codeql-extractor-iac" \
113- --clobber \
114- --pattern 'extractor-iac.tar.gz'
115-
116- tar -zxf extractor-iac.tar.gz
117-
118- - uses : dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
119- if : steps.extractor-changes.outputs.src == 'true'
120-
121- - name : " Build Extractor"
122- if : steps.extractor-changes.outputs.src == 'true'
123- env :
124- GH_TOKEN : ${{ github.token }}
125- run : |
126- set -e
127- gh extensions install github/gh-codeql
128- gh codeql set-version latest
129-
130- ./scripts/create-extractor-pack.sh
131-
132- gh codeql resolve languages --format=json --search-path ./extractor-pack
133-
134- - name : " Run CodeQL Analysis"
135- env :
136- GH_TOKEN : ${{ github.token }}
137- PROJECT_REPO : ${{ matrix.project }}
138- run : |
139- set -e
140- gh extensions install github/gh-codeql
141- gh codeql set-version latest
142-
143- gh codeql database create --language=iac --source-root=./project --search-path ./extractor-pack iac-db
144-
145- gh codeql database analyze --search-path ./extractor-pack --format sarif-latest --output="iac-${PROJECT_REPO}.sarif" iac-db ./ql/src
72+ # scanning:
73+ # runs-on: ubuntu-latest
74+ # needs: [tests]
75+
76+ # strategy:
77+ # matrix:
78+ # # project: ["hashicorp/terraform-guides", "akamai/terraform-examples", "aws-samples/aws-sam-terraform-examples"]
79+ # project: []
80+
81+ # steps:
82+ # - name: "Checkout"
83+ # uses: actions/checkout@v5
84+ # with:
85+ # submodules: true
86+
87+ # - name: "Checkout"
88+ # uses: actions/checkout@v5
89+ # with:
90+ # repository: ${{ matrix.project }}
91+ # path: project
92+
93+ # - name: "Check for changes"
94+ # uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
95+ # id: extractor-changes
96+ # with:
97+ # filters: |
98+ # src:
99+ # - 'extractor/**'
100+ # - 'rust-toolchain.toml'
101+ # - 'Cargo.*'
102+
103+ # - name: "Download Extracter"
104+ # if: steps.extractor-changes.outputs.src == 'false'
105+ # env:
106+ # GH_TOKEN: ${{ github.token }}
107+ # run: |
108+ # set -e
109+ # gh release list -L 1 -R "advanced-security/codeql-extractor-iac"
110+
111+ # gh release download \
112+ # -R "advanced-security/codeql-extractor-iac" \
113+ # --clobber \
114+ # --pattern 'extractor-iac.tar.gz'
115+
116+ # tar -zxf extractor-iac.tar.gz
117+
118+ # - uses: dtolnay/rust-toolchain@4305c38b25d97ef35a8ad1f985ccf2d2242004f2 # stable
119+ # if: steps.extractor-changes.outputs.src == 'true'
120+
121+ # - name: "Build Extractor"
122+ # if: steps.extractor-changes.outputs.src == 'true'
123+ # env:
124+ # GH_TOKEN: ${{ github.token }}
125+ # run: |
126+ # set -e
127+ # gh extensions install github/gh-codeql
128+ # gh codeql set-version latest
129+
130+ # ./scripts/create-extractor-pack.sh
131+
132+ # gh codeql resolve languages --format=json --search-path ./extractor-pack
133+
134+ # - name: "Run CodeQL Analysis"
135+ # env:
136+ # GH_TOKEN: ${{ github.token }}
137+ # PROJECT_REPO: ${{ matrix.project }}
138+ # run: |
139+ # set -e
140+ # gh extensions install github/gh-codeql
141+ # gh codeql set-version latest
142+
143+ # gh codeql database create --language=iac --source-root=./project --search-path ./extractor-pack iac-db
144+
145+ # gh codeql database analyze --search-path ./extractor-pack --format sarif-latest --output="iac-${PROJECT_REPO}.sarif" iac-db ./ql/src
146146
147147
148148 docs :
0 commit comments