CodeQL step configuration

Scan code repositories with CodeQL.

You can ingest scan results from CodeQL into Harness STO. The following steps outline the basic workflow:

The CodeQL step supports only Ingestion scan mode, refer to GitHub Advanced Security step documentation for Orchestration and other GHAS tools such as Dependabot, Secret Scanning.

1. Run a CodeQL scan, either externally or as part of a Run step, and publish the results to SARIF.

2. Add the SARIF data to your pipeline. If you ran the scan outside the pipeline, do the following:

   1. In the stage where you ingest the results, go to Overview > Shared Paths and create a folder under /shared such as /shared/scan_results.

   2. Use a Run step to add your scan results to the shared folder.

3. Use a CodeQL step to ingest the results.

This topic includes an end-to-end YAML pipeline that illustrates this workflow.

Important notes for running CodeQL scans in STO

Root access requirements

For more information

CodeQL step settings for STO scans

The recommended workflow is to add a CodeQL step to a Security or Build stage and then configure it as described below.

Scan

Scan mode

Scan configuration

Target

Type

Target and Variant Detection

Name

Variant

Ingestion file

Log Level

Additional CLI flags

Use this field to run the CodeQL scanner binary with additional flags.

Fail on Severity

Settings

Additional Configuration

Advanced settings

CodeQL pipeline example

The following pipeline illustrates a simple ingestion scan. It consists of two steps. A Run step generates an example CodeQL data file in SARIF format. A CodeQL step then ingests the data.

pipeline:
  projectIdentifier: STO
  orgIdentifier: default
  tags: {}
  stages:
    - stage:
        name: ingestion
        identifier: ingestion
        type: SecurityTests
        spec:
          cloneCodebase: false
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: K8S_DELEGATE_CONNECTOR
              namespace: harness-delegate-ng
              automountServiceAccountToken: true
              nodeSelector: {}
              os: Linux
          execution:
            steps:
              - step:
                  type: Run
                  name: create codeql sarif
                  identifier: create_codeql_sarif
                  spec:
                    connectorRef: CONTAINER_IMAGE_REGISTRY_CONNECTOR
                    image: alpine
                    shell: Sh
                    command: |-
                      pwd
                      echo '{
                          "$schema": "",
                          "version": "sarif-2.1.0",
                          "runs": [
                            {
                              "tool": {
                                "driver": {
                                  "name": "CodeQL",
                                  "version": "2.5.7",
                                  "semanticVersion": "2.5.7+1234567890",
                                  "informationUri": "https://github.com/github/codeql",
                                  "properties": {
                                    "analysisTarget": "myproject",
                                    "analysisTimestamp": "2023-04-03T14:00:00Z",
                                    "analysisDuration": 120000,
                                    "query": "detect-external-libs.ql",
                                    "queryUrl": "https://github.com/github/codeql/blob/master/javascript/ql/src/semmle/javascript/Security/CWE/CWE-094/ExternalLibraries.ql"
                                  }
                                }
                              },
                              "results": [
                                {
                                  "ruleId": "js/detect-external-libs",
                                  "message": {
                                    "text": "The following external libraries were found: jQuery, Lodash"
                                  },
                                  "locations": [
                                    {
                                      "physicalLocation": {
                                        "artifactLocation": {
                                          "uri": "/path/to/myproject/js/script.js"
                                        },
                                        "region": {
                                          "startLine": 10,
                                          "startColumn": 1,
                                          "endLine": 10,
                                          "endColumn": 15
                                        }
                                      }
                                    }
                                  ],
                                  "level": "warning",
                                  "properties": {
                                    "severity": "high",
                                    "confidence": "medium"
                                  }
                                }
                              ]
                            }
                          ]
                        }'> codeql.sarif
                      ls
              - step:
                  type: CodeQL
                  name: CodeQL_1
                  identifier: CodeQL_1
                  spec:
                    mode: ingestion
                    config: default
                    target:
                      name: login_microservice
                      type: repository
                      variant: my_hotfix_branch
                    advanced:
                      log:
                        level: info
                      fail_on_severity: critical
                    ingestion:
                      file: /harness/codeql.sarif
          sharedPaths:
            - /var/run
            - /shared/scan_results/
  identifier: codeql_ingestion
  name: codeql ingestion