11name : ATM Check Queries Run
22
33env :
4- AZURE_STORAGE_URL : " https://atmcodeqldata.blob.core.windows.net"
5- DB_NAME : " AmanSultanBaig/SignIn-SignUp-System-with-Nodejs"
64 DB_PATH : test_db
7- MODEL_BULDING_PACK_PATH : javascript/ql/experimental/adaptivethreatmodeling/modelbuilding
8- QUERY_SUITE : javascript/ql/experimental/adaptivethreatmodeling/src/ codeql-suites/javascript-atm-code-scanning.qls
5+ ATM_MODEL_PACK : javascript/ql/experimental/adaptivethreatmodeling/src
6+ QUERY_SUITE : codeql-suites/javascript-atm-code-scanning.qls
97
108on :
119 pull_request :
1210 paths :
13- - " javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/codeql-pack.lock.yml"
14- - " javascript/ql/experimental/adaptivethreatmodeling/modelbuilding/qlpack.yml"
15- - " javascript/experimental/adpativethreatmodeling/src/qlpack.yml"
16- - " javascript/experimental/adpativethreatmodeling/src/codeql-pack.lock.yml"
11+ - " .github/workflows/atm-check-queries-run.yml"
12+ - " javascript/ql/experimental/adaptivethreatmodeling/**"
1713 workflow_dispatch :
1814
1915jobs :
2218
2319 steps :
2420 - uses : actions/checkout@v3
25- with :
26- path : codeql-lib
2721
2822 - name : Install CodeQL CLI
2923 env :
@@ -32,48 +26,31 @@ jobs:
3226 gh extensions install github/gh-codeql
3327 gh codeql download
3428
35- - name : Download model pack
29+ - name : Install ATM model pack
3630 env :
3731 GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
38- STORAGE_SAS : ${{ secrets.AZURE_BLOB_STORAGE_ATMCODEQLDATA_SAS }}
3932 run : |
40- echo "::group::Download ATM model pack"
4133 set -exu
34+
35+ # Install ATM model pack
36+ gh codeql pack install ${ATM_MODEL_PACK}
4237
43- # Get pack version and checksum
44- pack_version=$(yq '.dependencies.codeql/javascript-experimental-atm-model' ./codeql-lib/${MODEL_BULDING_PACK_PATH}/qlpack.yml )
45- model_checksum="${pack_version##*.}"
46- echo "Will use pack model ${pack_version} with model checksum ${model_checksum}."
47-
48- # Download the model to the package cache
49- tmp_dir=$(mktemp -d)
50- gh codeql pack download codeql/javascript-experimental-atm-model@${pack_version}
38+ # Retrieve model checksum
39+ model_checksum=$(gh codeql resolve extensions ${ATM_MODEL_PACK}/${QUERY_SUITE} | jq -r '.models[0].checksum')
5140
5241 # Trust the model so that we can use it in the ATM boosted queries
5342 mkdir -p "$HOME/.config/codeql"
5443 echo "--insecurely-execute-ml-model-checksums ${model_checksum}" >> "$HOME/.config/codeql/config"
55- echo "::endgroup::"
5644
5745 - name : Create test DB
5846 env :
5947 GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
6048 run : |
61- echo "::group::Create test database"
62- gh repo clone ${DB_NAME} -- --depth 1
63- gh codeql database create ${DB_PATH} --language javascript
64- echo "::endgroup::"
49+ gh codeql database create ${RUNNER_TEMP}/${DB_PATH} --source-root config/atm/ --language javascript
6550
6651 - name : Run ATM query suite
6752 env :
6853 GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
6954 run : |
70- echo "::group::Run boosted query suite"
71- gh codeql database run-queries -vv -- ${DB_PATH} codeql-lib/${QUERY_SUITE}
72- if [[ $? -ne 0 ]]; then
73- echo "Failed to run the ATM query suite."
74- exit 1
75- else
76- echo "Successfully run ATM query suite."
77- fi
78- echo "::endgroup::"
55+ gh codeql database run-queries -vv -- ${RUNNER_TEMP}/${DB_PATH} ${ATM_MODEL_PACK}/${QUERY_SUITE}
7956
0 commit comments