Skip to content

Commit

Permalink
Clean up README
Browse files Browse the repository at this point in the history
Restructured the change to the README. Instead of directly including the
descriptions of the language inputs, added links to the inputs for each
action.
  • Loading branch information
aeisenberg committed Aug 9, 2024
1 parent d5ec7f0 commit 885261b
Showing 1 changed file with 16 additions and 21 deletions.
37 changes: 16 additions & 21 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,24 @@ We recommend using default setup to configure CodeQL analysis for your repositor

You can also configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration. For more information, see "[Configuring advanced setup for code scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/configuring-advanced-setup-for-code-scanning)" and "[Customizing your advanced setup for code scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning)."

### Inputs
### Actions

This repository contains several actions that enable you to create and upload your CodeQL analyses to GitHub Code Scanning. Also, you can upload analyses generated by any SARIF-producing SAST tool using actions in this repository.

Actions for CodeQL analyses:

- `init`: Sets up CodeQL for analysis. For information about input parameters, see the [init action definition](https://github.com/github/codeql-action/blob/main/init/action.yml).
- `autobuild`: Attempts to automatically build the code. Only used for analyzing languages that require a build. For information about input parameters, see the [autobuild action definition](https://github.com/github/codeql-action/blob/main/autobuild/action.yml).
- `analyze`: Finalizes the CodeQL database and runs the analysis. For information about input parameters, see the [analyze action definition](https://github.com/github/codeql-action/blob/main/analyze/action.yml).

Actions for uploading analyses generated by third-party tools:

The CodeQL Action supports various inputs to customize the analysis. Here are some important inputs:
- `upload-sarif`: Uploads a SARIF file to Code Scanning. For information about input parameters, see the [upload-sarif action definition](https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml).

- `config`: Path of the config file to use. This input allows you to specify a custom configuration file for the analysis.
- `languages`: A comma-separated list of CodeQL languages to analyze.
- `queries`: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
- `packs`: Comma-separated list of packs to run. Reference a pack in the format `scope/name[@version]`. If `version` is not specified, then the latest version of the pack is used. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of packs.
- `db-location`: Path where CodeQL databases should be created. If not specified, a temporary directory will be used.
- `ram`: The amount of memory in MB that can be used by CodeQL extractors.
- `threads`: The number of threads that can be used by CodeQL extractors.
- `source-root`: Path of the root source code directory, relative to $GITHUB_WORKSPACE.
Actions with special purposes and unlikely to be used directly:

- `resolve-environment`: Attempts to infer a build environment suitable for automatic builds. For information about input parameters, see the [resolve-environment action definition](https://github.com/github/codeql-action/blob/main/resolve-environment/action.yml).
- `start-proxy`: Starts an HTTP proxy server for downloading dependencies in private registries. For information about input parameters, see the [start-proxy action definition](https://github.com/github/codeql-action/blob/main/start-proxy/action.yml).

### Workflow Permissions

Expand All @@ -41,17 +47,6 @@ The CodeQL Action supports different build modes for analyzing the source code.
- `autobuild`: The database will be created by attempting to automatically build the source code. Available for all compiled languages.
- `manual`: The database will be created by building the source code using a manually specified build command. To use this build mode, specify manual build steps in your workflow between the `init` and `analyze` steps. Available for all compiled languages.

### Actions

The CodeQL Action includes several actions that can be used in your workflows. Here are the available actions and how to use them:

- `init`: Sets up CodeQL for analysis. For more information, see the [init action documentation](https://github.com/github/codeql-action/blob/main/init/action.yml).
- `autobuild`: Attempts to automatically build the code. For more information, see the [autobuild action documentation](https://github.com/github/codeql-action/blob/main/autobuild/action.yml).
- `analyze`: Finalizes the CodeQL database and runs the analysis. For more information, see the [analyze action documentation](https://github.com/github/codeql-action/blob/main/analyze/action.yml).
- `upload-sarif`: Uploads a SARIF file to Code Scanning. For more information, see the [upload-sarif action documentation](https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml).
- `resolve-environment`: Attempts to infer a build environment suitable for automatic builds. For more information, see the [resolve-environment action documentation](https://github.com/github/codeql-action/blob/main/resolve-environment/action.yml).
- `start-proxy`: Starts an HTTP proxy server. For more information, see the [start-proxy action documentation](https://github.com/github/codeql-action/blob/main/start-proxy/action.yml).

## Supported versions of the CodeQL Action

The following versions of the CodeQL Action are currently supported:
Expand Down

0 comments on commit 885261b

Please sign in to comment.