Skip to content

Iac file cleanup #385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chanel-y wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Iac file cleanup #385

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions iac/.codeqlmanifest.json
View file
Open in desktop

This file was deleted.

6 changes: 3 additions & 3 deletions iac/docs/workflows.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,10 +70,10 @@ The CodeQL CLI can be used to analyze IaC files using the CodeQL Extractor, Libr
3. Check the extractor is installed correctly by running:
- `codeql resolve languages` and checking if `iac` is listed
4. Install the IaC queries pack by running:
- `codeql pack install advanced-security/iac-queries`
- `codeql pack install microsoft/iac-queries`
5. Run the CodeQL database commands to create and analyze the IaC files
- `codeql database create <database-name> --language=iac --source-root=<path-to-iac-files>`
- `codeql database analyze <database-name> --format=sarif-latest --output=<output-file-name> advanced-security/iac-queries`
- `codeql database analyze <database-name> --format=sarif-latest --output=<output-file-name> microsoft/iac-queries`

### CLI Example

Expand Down Expand Up @@ -108,5 +108,5 @@ codeql database analyze \
--format="sarif-latest" \
--output="./codeql-iac.sarif" \
"$CODEQL_DATABASE" \
"advanced-security/iac-queries"
"microsoft/iac-queries"
```
6 changes: 1 addition & 5 deletions iac/ql/lib/codeql-pack.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
---
lockVersion: 1.0.0
dependencies:
codeql/util:
version: 1.0.12
codeql/yaml:
version: 1.0.25
dependencies: {}
compiled: false
6 changes: 1 addition & 5 deletions iac/ql/src/codeql-pack.lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
---
lockVersion: 1.0.0
dependencies:
codeql/util:
version: 1.0.12
codeql/yaml:
version: 1.0.25
dependencies: {}
compiled: false
8 changes: 3 additions & 5 deletions iac/ql/test/qlpack.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,8 @@
name: advanced-security/iac-tests
name: microsoft/iac-tests
groups: [iac, test]
dependencies:
dependencies:
advanced-security/iac-all: ${workspace}
advanced-security/iac-queries: ${workspace}
extractor: iac
microsoft/iac-all: ${workspace}
microsoft/iac-queries: ${workspace}
extractor: iac
tests: .
warnOnImplicitThis: true
17 changes: 15 additions & 2 deletions iac/tools/qltest.cmd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,24 @@
@echo off

type NUL && "%CODEQL_DIST%\codeql.exe" database index-files ^
"%CODEQL_DIST%\codeql.exe" database index-files ^
--prune=**/*.testproj ^
--include-extension=.hcl ^
--include-extension=.tf ^
--include-extension=.tfvars ^
--include-extension=.bicep ^
--size-limit=5m ^
--language=hcl ^
--language=iac ^
--working-dir=. ^
"%CODEQL_EXTRACTOR_IAC_WIP_DATABASE%"
if %ERRORLEVEL% neq 0 exit /b %ERRORLEVEL%

"%CODEQL_DIST%\codeql.exe" database index-files ^
--prune=**/*.testproj ^
--include-extension=.yml ^
--include-extension=.yaml ^
--include-extension=.json ^
--size-limit=5m ^
--language=yaml ^
--working-dir=. ^
"%CODEQL_EXTRACTOR_IAC_WIP_DATABASE%"

Expand Down
Loading