Configuration File Not Found

[ArielSAdamsNASA]

I was trying to disable default queries in a configuration file. After noticing that my configuration file is no longer affecting the CodeQL workflow as it normally did, I looked in the Initialize CodeQL log and discovered:

"configFileLocation" : "/home/runner/.config/codeql/config",
    "configFileFound" : false

This also occurs in your most recent workflow in Run /./init and Print CodeQL Version: https://github.com/github/codeql-action/runs/2172716823?check_suite_focus=true

[robertbrignull]

@ArielSAdamsNASA, maybe you already realised and that's why you closed this issue, but the log line "configFileFound" : false is output from CodeQL itself and not from the codeql-action. It's a bit confusing but they're talking about separate config files. If changes to the codeql-action config file (as described at https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#using-a-custom-configuration-file) are not working then let us know, but currently that log output doesn't show that anything's wrong.

[ArielSAdamsNASA]

@robertbrignull Thank you. I realized that after taking a closer look.

I am still having issues with the configuration file working. A few months ago, I started using a configuration file for CodeQL that just contained the two security query suites such as security-extended. The configuration file worked correctly since running CodeQL with the new suites generated more code scanning alerts compared to the original run. I am now trying to disable all the default queries and run custom queries using disable-default-queries: true. After noticing that CodeQL is not disabling any queries, I removed the security suites and ran CodeQL again. Then I added the security suites again to discover that the code scanning alerts did not change. I am testing the configuration file on a forked repo, but that shouldn't affect CodeQL right? The configuration file name and location, as well as the CodeQL.yml file contents has not changed from the original repo which was working.

[robertbrignull]

It's worth noting that the suites like security-extended and security-and-quality both contain the default queries as a subset, so if you disabled the default queries but kept one of those extra suites then you'd still be running the default queries. However if you disabled the default queries and didn't include any other suites then you shouldn't be running anything from the default query set.

When you say "Then I added the security suites again to discover that the code scanning alerts did not change" do you mean the PR said it didn't introduce any alerts? I think what may have happened is that for the time while literally all queries were disabled the codeql workflow was not running successfully. Perhaps this is not helpful behaviour but I believe the workflow will fail if there are no queries to run, so then it wouldn't upload a SARIF file to close any existing alerts, and thus when you reintroduced the queries there weren't any new alerts because they never closed.

If you link to your repo I can see if I can tell what happened.

[ArielSAdamsNASA]

When you say "Then I added the security suites again to discover that the code scanning alerts did not change" do you mean the PR said it didn't introduce any alerts?

For clarification, on my local repo, I deleted all the code scanning alerts before making any changes. Then, I updated the configuration file that originally contained both the security query suites and removed them both. This workflow resulted in 84 alerts. I deleted all the code scanning alerts again and reverted the changes so the security suites are used in the configuration file. After the workflow ran, it resulted in 84 alerts which is the same amount as the previous workflow that excluded these suites. Both of these tests did not include the disable-default-queries: true configuration. My CodeQL workflow runs on push, so the workflows ran automatically with the new configuration changes. I did these tests to see if the workflow was noticing any changes in the configuration file since it was not detecting disable-default-queries: true beforehand.

Perhaps this is not helpful behavior but I believe the workflow will fail if there are no queries to run, so then it wouldn't upload a SARIF file to close any existing alerts, and thus when you reintroduced the queries there weren't any new alerts because they never closed.

I was theorizing this may be the case. So, after noticing that disable-default-queries: true did not work. I added a custom query to see if CodeQL will disable all default queries besides the custom query. For the query, it was one of the JPL rules from the main CodeQL repo. This initial test did not contain any of the security suites in the configuration file.

My tests are ran under the branch CodeQLCodingStandardTest.

This is the latest CodeQL run that has disable-default-queries: true and the custom query. As you may notice, it runs all the default queries in Perform CodeQL Analysis.

Thank you for the help!!

[robertbrignull]

Thank you for the detailed explanation and the link. That was very helpful. Thankfully I think I see the problem.

I can see that on your branch in your fork the code contains disable-default-queries: true in https://github.com/ArielSAdamsNASA/cFS/blob/ae821e7942c335907428b75a44d1339b281bb90f/.github/codeql/codeql-config.yml

However the workflow looks like

      - name: Checkout code
        uses: actions/checkout@v2
        with:
          repository: nasa/cFS
          submodules: true

which means it's always checking out the repository from nasa/cFS instead of ArielSAdamsNASA/cFS. Normally the checkout action auto-detects the correct repository and commit to run on based on the current workflow run, but because an explicit repository is being specified it's probably always checking out the default branch from there.

I believe it should start working as you intended it if you either change that repository name in the checkout action call to your fork, or if you just delete it then it will auto-detect the repository that the workflow is running on.

[ArielSAdamsNASA]

Thank you! I was able to get the configuration file to identify the custom queries I added.

Now I am stuck with CodeQL running the queries. I am using the JPL rules from CodeQL as custom queries. When running, I am getting errors on modules and types. For example:

  Running queries.
  Compiling query plan for /home/runner/work/cFS/cFS/.github/codeql/JPL_C/Rule 07/ThreadSafety.ql.
  ERROR: Could not resolve module cpp. You probably need to depend on a basic libary pack in /home/runner/work/cFS/cFS/.github/codeql/qlpack.yml. (/home/runner/work/cFS/cFS/.github/codeql/JPL_C/Rule 07/ThreadSafety.ql:12,8-11)
  ERROR: Could not resolve type FunctionCall (/home/runner/work/cFS/cFS/.github/codeql/JPL_C/Rule 07/ThreadSafety.ql:14,29-41)
  ERROR: getTarget() cannot be resolved for type ForbiddenCall.extends (/home/runner/work/cFS/cFS/.github/codeql/JPL_C/Rule 07/ThreadSafety.ql:16,10-19)
  ERROR: ForbiddenCall must implement toString() (/home/runner/work/cFS/cFS/.github/codeql/JPL_C/Rule 07/ThreadSafety.ql:14,7-20)
  Error: The process '/opt/hostedtoolcache/CodeQL/0.0.0-20210308/x64/codeql/codeql' failed with exit code 2
  Error: Error running analysis for cpp: Error: The process '/opt/hostedtoolcache/CodeQL/0.0.0-20210308/x64/codeql/codeql' failed with exit code 2

I am using a qlpack.yml file as the documentation instructed. Currently it contains:

name: codeql-cpp
version: 0.0.0
libraryPathDependencies: codeql-cpp
extractor: cpp

I assume it has something to do with libraryPathDependencies, but I am having a hard time understanding this concept.

[adityasharad]

Please try changing the name of your pack from codeql-cpp to something else, say nasa-codeql-cpp. The name clash with the CodeQL C++ standard library (which is named codeql-cpp) means that you've written a circular dependency, and won't find the standard library. :)

I think you can also omit the extractor field, assuming your pack only contains custom queries.

With these changes, your qlpack.yml will look something like:

name: nasa-codeql-cpp
version: 0.0.0
libraryPathDependencies: codeql-cpp

This follows the examples given for query packs containing custom queries, in the docs you're referring to: https://codeql.github.com/docs/codeql-cli/about-ql-packs/#ql-packs-for-custom-queries

[ArielSAdamsNASA]

Thanks again!