Allow the codeql-action to be run locally #117

aeisenberg · 2020-07-20T22:46:37Z

This change allows the codeql-action to be run locally through
act.

In order to run the action locally, you need to do two things:

Add the CODEQL_LOCAL_RUN: true environment variable. The only way
I could figure out how to do this was to add it directly in the
workflow file in an env block. It should be possible to add it
through a .env file and pass it to act, but I couldn't get it
working.
Run this command act -j codeql -s GITHUB_TOKEN=<MY_PAT>

Setting the CODEQL_LOCAL_RUN env var will fill in missing env vars
that the action needs, but isn't set by act. It will also avoid
making api calls to github that would fail locally.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Confirm the readme has been updated if necessary.

aibaars · 2020-07-21T08:14:09Z

src/util.ts

+  }
+
+  core.debug('Action is running locally.');
+  if (!process.env.RUNNER_TEMP) {


I'm a bit surprise that this line is needed. See also https://github.com/nektos/act/blob/64b8d2afa47ff6938d7617e00f1260a95c35268e/pkg/runner/run_context.go#L82

When I run a workflow containing the following with act

- run: | printenv

I see that RUNNER_TEMP=/tmp.

Hmmmm. Again, this was not the case for me. I must be running things differently somehow or a different version of act. I'll have to explore.

Ha! Upgraded from 0.2.7 -> 0.2.10 and that environment variable is now being set. Knowing this yesterday would have made things go a lot more smoothly.

Thanks for catching that.

aibaars · 2020-07-21T09:10:41Z

Setting variables in a file named .env seems to work for me. Note that the flag is just a filename, which is resolved against the current working directory.

aeisenberg · 2020-07-21T14:22:12Z

Hmmm...The .env did not work for me. I wonder if I'm using an older version than you. Also, are you on Linux?

aibaars · 2020-07-21T14:36:31Z

Hmmm...The .env did not work for me. I wonder if I'm using an older version than you. Also, are you on Linux?

Yes, on linux.

robertbrignull · 2020-07-21T15:28:28Z

When generating the status reports, we access the github API to get the workflow ID. This would also need to be dealt with somehow. Probably best to audit all uses of the getApiClient method.

aeisenberg · 2020-07-21T15:33:53Z

@robertbrignull I believe that is already handled here: https://github.com/github/codeql-action/pull/117/files#diff-8cd4968b81985f0efc2053eabc37db6dR263

Under local mode, no status messages are sent.

There is at least one call to apiClient that we need https://github.com/github/codeql-action/blob/main/src/config-utils.ts#L404. Though, I could probably still explicitly fail other requests if they are invoked from local mode.

robertbrignull · 2020-07-21T15:47:53Z

I believe that is already handled here: https://github.com/github/codeql-action/pull/117/files#diff-8cd4968b81985f0efc2053eabc37db6dR263

That stops the reports from being sent, but the call I was thinking of is when we are constructing the data to send, which happens before that. However now I look closely it is already covered by https://github.com/github/codeql-action/pull/117/files#diff-8cd4968b81985f0efc2053eabc37db6dR102 as this is the method I was thinking of.

There is at least one call to apiClient that we need https://github.com/github/codeql-action/blob/main/src/config-utils.ts#L404. Though, I could probably still explicitly fail other requests if they are invoked from local mode.

I haven't used act before. Presumably it still runs in the context of some repository? In which case I expect that call should work as normal. I do wonder if it would make for a safer situation if we took the stance of denying all HTTP requests in local mode, and allowing only the ones we know to be safe, instead of the current situation which is the opposite.

aeisenberg · 2020-07-21T15:52:46Z

Yes, that is what I was proposing indirectly above. I could do something like this:

export const getApiClient = function(allowLocalRun = false) {
  if (isLocalRun() && !allowLocalRun) {
    throw new Error('Invalid API call in local run');
  }
  ...

And then for calls we know to be safe, we pass the true flag. And for calls that aren't, we will fail-fast and then need to handle them differently.

aeisenberg · 2020-07-21T20:13:30Z

I'm confused why I'm getting errors on the Code scanning action. This is coming from code that I don't think I have changed. It looks like this check was not run for #116, though it was run for #115 (and it failed, too, but for different checks).

Is it possible the codeql action is not being run for local pull requests?

aeisenberg · 2020-07-21T20:16:38Z

Even more confusing is that this failing check is not showing up in the actions tab, but previous calls to the codeql actions were invoked on this branch and were successful. Eg- https://github.com/github/codeql-action/actions/runs/176329168

robertbrignull · 2020-07-23T07:53:21Z

The Code Scanning check is the one that reports changes in alerts. So when it is marked as failed it's because that PR introduces alerts. Things might be a little confused right now because we had to revert some changes to the main branch so this reintroduced some alerts to that branch that had been fixed.

aeisenberg · 2020-07-23T13:42:12Z

Thanks for the clarification.

aeisenberg · 2020-07-29T17:36:46Z

@robertbrignull is this a worthwhile thing to add to the action?

robertbrignull

Sorry this languished slightly. I wasn't sure if @aibaars was going to carry on reviewing.

I've made a couple of extra comments and then I'd be happy for this to go in. It's probably not a feature that I will use myself when testing the action, but I can see that it would be very useful for codeql.

robertbrignull · 2020-07-30T09:34:02Z

src/util.ts

+/**
+ * Ensures all required environment variables are set in the context of a local run.
+ */
+export function prepareEnvironment() {


Could the name of this be something like prepareLocalRunEnvironment so it's more clear what it does?

Also, this isn't called at the start of the uploadSarif action. I guess the reason for that is that you'd never want to run that action in local mode, however I'm worried it could lead to bugs or misunderstandings in the future if someone modifies this function and assumes it's there.

robertbrignull · 2020-07-30T10:08:03Z

src/finalize-db.ts

    await runQueries(databaseFolder, sarifFolder, config);

-    if ('true' === core.getInput('upload')) {
+    if ('true' === core.getInput('upload') && !util.isLocalRun()) {


Could you move this check to inside the upload_lib.upload method? That way it'll cover the uploadSarif action too.

Also from the point of view of testing more code in the action, it might be better to move this check to immediately before we make the action upload, in order to skip less code. The only major thing this would affect is the fingerprinting code, which might be nice to test but is not essential.

Make sense.

robertbrignull · 2020-07-30T10:08:47Z

src/api-client.ts

-export const getApiClient = function() {
+import { isLocalRun } from "./util";
+
+export const getApiClient = function(allowLocalRun = false) {


Thanks for adding this. I like that API calls are now safe by default in local mode.

sampart · 2020-07-30T14:29:42Z

Please could you update CONTRIBUTING.md as part of this - there's a Running the action section there. Thanks!

aeisenberg · 2020-07-30T14:47:51Z

@sampart I added a section to the readme. Should I move that to contributing?

sampart · 2020-07-30T15:01:29Z

Actually, moving it sounds like a great idea, thanks. Please don't fully replace what's there, as I think it's helpful that we also tell people about the option of pushing a branch (that's simpler than using act), but please do add the info in. I don't think we need it in the README if it's in the Contributing guide. Thanks!

aeisenberg · 2020-07-30T15:23:44Z

Right...this is a little different from the Running the action section. The instructions are for running from the main repository, but locally through act. So, to get this working, you need to run this from a repository different from this one. And it will used the current code in this repository. It's a subtle difference that I didn't call out in the README. I'll make that explicit. The main use case is to debug why a specific repository's codeql action is failing.

sampart · 2020-07-30T15:28:32Z

Oh, I totally hadn't realised that distinction, thanks for mentioning. Would an end-user of the action use this to troubleshoot their own workflows that use the action? If so, README would be the right place for this, after all.

CONTRIBUTING.md

aeisenberg · 2020-07-30T16:10:35Z

@sampart Probably not useful for end users. So, I think contributing is the right place for it. When I discussed this earlier, the use case would be for maintainers or contributors to determine why a particular repository is failing by reproducing locally.

robertbrignull · 2020-07-30T16:21:32Z

@aeisenberg a bunch of js files have got into the src directory somehow. They should be in lib, so I'm not sure how that happened.

aeisenberg · 2020-07-30T16:22:10Z

Darn. Let me fix that. Not sure what I did.

aeisenberg · 2020-07-30T21:53:38Z

I'm out tomorrow and Monday. Please merge if you feel like this is good. Otherwise, I'll look at it when I get back.

- Throw error if apiClient is retrieved for local runs and the `allowLocalRuns` flag isn't set. - Better debugging for `sendStatusReport`

This ensures that as much of the normal workflow occurs without doing the actual upload.

Co-authored-by: Joshua Hale <joshhale@github.com>

aibaars reviewed Jul 21, 2020

View reviewed changes

aeisenberg force-pushed the aeisenberg/local-runs branch from 3966be4 to cd5c2ae Compare July 21, 2020 19:04

aeisenberg force-pushed the aeisenberg/local-runs branch from ac386f7 to ed210a5 Compare July 22, 2020 20:59

aeisenberg changed the base branch from v1 to main July 22, 2020 21:05

aeisenberg force-pushed the aeisenberg/local-runs branch from 5f292ee to b0ece22 Compare July 22, 2020 21:49

robertbrignull approved these changes Jul 30, 2020

View reviewed changes

robertbrignull mentioned this pull request Jul 30, 2020

Avoid sending status reports on enterprise #128

Merged

4 tasks

aeisenberg force-pushed the aeisenberg/local-runs branch from b0ece22 to 105f781 Compare July 30, 2020 14:26

joshhale reviewed Jul 30, 2020

View reviewed changes

CONTRIBUTING.md Outdated Show resolved Hide resolved

aeisenberg and others added 7 commits August 4, 2020 11:02

Some fixes for local runs

12ad05d

- Throw error if apiClient is retrieved for local runs and the `allowLocalRuns` flag isn't set. - Better debugging for `sendStatusReport`

Update readme

5c991a9

Fix tests

4a53919

Move isLocalRun check to inside upload sarif

5706df3

This ensures that as much of the normal workflow occurs without doing the actual upload.

Move run locally documentation from readme to contributing

633beb4

Update CONTRIBUTING.md

972965e

Co-authored-by: Joshua Hale <joshhale@github.com>

Allow langauges call to be run locally

36fef7c

aeisenberg force-pushed the aeisenberg/local-runs branch from ffef8a4 to 36fef7c Compare August 4, 2020 18:02

aeisenberg merged commit 42235cc into github:main Aug 4, 2020

github-actions bot mentioned this pull request Aug 10, 2020

Merge main into v1 #143

Merged

robertkowalski mentioned this pull request Mar 3, 2022

Issue: Not Found Http Error on CodeQL job nektos/act#1025

Closed

katelovescode mentioned this pull request Mar 7, 2022

CodeQL won't run locally using act #967

Open

aliscco mentioned this pull request Apr 24, 2023

[Snyk] Fix for 5 vulnerabilities aliscco/codeql-action#62

Open

snyk-bot mentioned this pull request Apr 24, 2023

[Snyk] Fix for 5 vulnerabilities aliscco/codeql-action#64

Open

This was referenced Apr 24, 2023

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#75

Open

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#76

Open

This was referenced Apr 24, 2023

[Snyk] Fix for 3 vulnerabilities aliscco/codeql-action#83

Open

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#84

Open

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#86

Open

aliscco mentioned this pull request Apr 24, 2023

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#88

Open

This was referenced Apr 24, 2023

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#90

Open

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#92

Open

[Snyk] Fix for 4 vulnerabilities aliscco/codeql-action#95

Open

Allow the codeql-action to be run locally #117

Allow the codeql-action to be run locally #117

Uh oh!

Conversation

aeisenberg commented Jul 20, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge / deployment checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aibaars commented Jul 21, 2020

Uh oh!

aeisenberg commented Jul 21, 2020

Uh oh!

aibaars commented Jul 21, 2020

Uh oh!

robertbrignull commented Jul 21, 2020

Uh oh!

aeisenberg commented Jul 21, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robertbrignull commented Jul 21, 2020

Uh oh!

aeisenberg commented Jul 21, 2020

Uh oh!

aeisenberg commented Jul 21, 2020

Uh oh!

aeisenberg commented Jul 21, 2020

Uh oh!

robertbrignull commented Jul 23, 2020

Uh oh!

aeisenberg commented Jul 23, 2020

Uh oh!

aeisenberg commented Jul 29, 2020

Uh oh!

robertbrignull left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sampart commented Jul 30, 2020

Uh oh!

aeisenberg commented Jul 30, 2020

Uh oh!

sampart commented Jul 30, 2020

Uh oh!

aeisenberg commented Jul 30, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sampart commented Jul 30, 2020

Uh oh!

Uh oh!

aeisenberg commented Jul 30, 2020

Uh oh!

robertbrignull commented Jul 30, 2020

Uh oh!

aeisenberg commented Jul 30, 2020

Uh oh!

aeisenberg commented Jul 30, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

aeisenberg commented Jul 20, 2020 •

edited

Loading

aeisenberg commented Jul 21, 2020 •

edited

Loading

aeisenberg commented Jul 30, 2020 •

edited

Loading