зеркало из https://github.com/github/docs.git
[Ready to ship] Code scanning - diagnostic information (GA) (#19653)
* made a start * more work * made improvements * finish work on article * fix broken links * really fix broken link + remove empty line * add space * remove full stops in table * start addressing comments * Update content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/viewing-code-scanning-logs.md Co-authored-by: Felicity Chapman <felicitymay@github.com> * address more comments * and more * rework! * small fixes * add missing endif tag * start addressing comments * Apply suggestions from code review Co-authored-by: Felicity Chapman <felicitymay@github.com> Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com> * make docs more evergreen * Apply suggestions from code review Co-authored-by: Felicity Chapman <felicitymay@github.com> * For some reason the H2 headings don't stick Co-authored-by: Felicity Chapman <felicitymay@github.com> Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
This commit is contained in:
mc
GitHub
Родитель
8cf1687bca
Коммит
30127f0fb4
Двоичный файл не отображается.
|
После Ширина: | Высота: | Размер: 45 KiB |
|
|
@ -21,5 +21,6 @@ children:
|
|||
- /configuring-the-codeql-workflow-for-compiled-languages
|
||||
- /troubleshooting-the-codeql-workflow
|
||||
- /running-codeql-code-scanning-in-a-container
|
||||
- /viewing-code-scanning-logs
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
|
|
|||
|
|
@ -65,6 +65,17 @@ You need write permission to view a summary of all the alerts for a repository o
|
|||
1. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code.
|
||||
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" %}
|
||||
{% note %}
|
||||
|
||||
**Note:** For {% data variables.product.prodname_code_scanning %} analysis with {% data variables.product.prodname_codeql %}, you can see information about the latest run in a header at the top of the list of {% data variables.product.prodname_code_scanning %} alerts for the repository.
|
||||
|
||||
For example, you can see when the last scan ran, the number of lines of code analyzed compared to the total number of lines of code in your repository, and the total number of alerts that were generated.
|
||||
|
||||
|
||||
{% endnote %}
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" %}
|
||||
## Searching {% data variables.product.prodname_code_scanning %} alerts
|
||||
|
||||
|
|
|
|||
|
|
@ -58,38 +58,6 @@ In the default {% data variables.product.prodname_codeql_workflow %}, {% data va
|
|||
## Bulk set up of {% data variables.product.prodname_code_scanning %}
|
||||
You can set up {% data variables.product.prodname_code_scanning %} in many repositories at once using a script. For an example of a script that raises pull requests to add a {% data variables.product.prodname_actions %} workflow to multiple repositories, see the [`jhutchings1/Create-ActionsPRs`](https://github.com/jhutchings1/Create-ActionsPRs) repository.
|
||||
|
||||
## Viewing the logging output from {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
After setting up {% data variables.product.prodname_code_scanning %} for your repository, you can watch the output of the actions as they run.
|
||||
|
||||
{% data reusables.repositories.actions-tab %}
|
||||
|
||||
You'll see a list that includes an entry for running the {% data variables.product.prodname_code_scanning %} workflow. The text of the entry is the title you gave your commit message.
|
||||
|
||||
|
||||
|
||||
1. Click the entry for the {% data variables.product.prodname_code_scanning %} workflow.
|
||||
|
||||
1. Click the job name on the left. For example, **Analyze (LANGUAGE)**.
|
||||
|
||||
|
||||
|
||||
1. Review the logging output from the actions in this workflow as they run.
|
||||
|
||||
1. Once all jobs are complete, you can view the details of any {% data variables.product.prodname_code_scanning %} alerts that were identified. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository)."
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** If you raised a pull request to add the {% data variables.product.prodname_code_scanning %} workflow to the repository, alerts from that pull request aren't displayed directly on the {% data variables.product.prodname_code_scanning_capc %} page until the pull request is merged. If any alerts were found you can view these, before the pull request is merged, by clicking the **_n_ alerts found** link in the banner on the {% data variables.product.prodname_code_scanning_capc %} page.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
|
||||
{% else %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% endnote %}
|
||||
|
||||
## Understanding the pull request checks
|
||||
|
||||
Each {% data variables.product.prodname_code_scanning %} workflow you set to run on pull requests always has at least two entries listed in the checks section of a pull request. There is one entry for each of the analysis jobs in the workflow, and a final one for the results of the analysis.
|
||||
|
|
@ -135,5 +103,6 @@ After setting up {% data variables.product.prodname_code_scanning %}, and allowi
|
|||
- View all of the {% data variables.product.prodname_code_scanning %} alerts generated for this repository. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository)."
|
||||
- View any alerts generated for a pull request submitted after you set up {% data variables.product.prodname_code_scanning %}. For more information, see "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
- Set up notifications for completed runs. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-actions-notification-options)."
|
||||
- View the logs generated by the {% data variables.product.prodname_code_scanning %} analysis. For more information, see "[Viewing {% data variables.product.prodname_code_scanning %} logs](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/viewing-code-scanning-logs)."
|
||||
- Investigate any problems that occur with the initial setup of {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}. For more information, see "[Troubleshooting the {% data variables.product.prodname_codeql %} workflow](/code-security/secure-coding/troubleshooting-the-codeql-workflow)."
|
||||
- Customize how {% data variables.product.prodname_code_scanning %} scans the code in your repository. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %}](/code-security/secure-coding/configuring-code-scanning)."
|
||||
|
|
|
|||
|
|
@ -0,0 +1,78 @@
|
|||
---
|
||||
title: Viewing code scanning logs
|
||||
intro: 'You can view the output generated during {% data variables.product.prodname_code_scanning %} analysis in {% data variables.product.product_location %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
permissions: 'If you have write permissions to a repository, you can view the {% data variables.product.prodname_code_scanning %} logs for that repository.'
|
||||
miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=3.0'
|
||||
github-ae: '*'
|
||||
topics:
|
||||
- Security
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
||||
## About your {% data variables.product.prodname_code_scanning %} setup
|
||||
|
||||
You can use a variety of tools to set up {% data variables.product.prodname_code_scanning %} in your repository. For more information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository#options-for-setting-up-code-scanning)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
The log and diagnostic information available to you depends on the method you use for {% data variables.product.prodname_code_scanning %} in your repository. You can check the type of {% data variables.product.prodname_code_scanning %} you're using in the **Security** tab of your repository, by using the **Tool** drop-down menu in the alert list. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository)."
|
||||
|
||||
## About analysis and diagnostic information
|
||||
|
||||
You can see analysis and diagnostic information for {% data variables.product.prodname_code_scanning %} run using {% data variables.product.prodname_codeql %} analysis on {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
**Analysis** information is shown for the most recent analysis in a header at the top of the list of alerts. For more information, see "[Managing code scanning alerts for your repository](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository)."
|
||||
|
||||
**Diagnostic** information is displayed in the Action workflow logs and consists of summary metrics and extractor diagnostics. For information about accessing {% data variables.product.prodname_code_scanning %} logs on {% data variables.product.prodname_dotcom %}, see "[Viewing the logging output from {% data variables.product.prodname_code_scanning %}](#viewing-the-logging-output-from-code-scanning)" below.
|
||||
|
||||
If you're using the {% data variables.product.prodname_codeql_cli %} outside {% data variables.product.prodname_dotcom %}, you'll see diagnostic information in the output generated during database analysis. This information is also included in the SARIF results file you upload to {% data variables.product.prodname_dotcom %} with the {% data variables.product.prodname_code_scanning %} results.
|
||||
|
||||
For information about the {% data variables.product.prodname_codeql_cli %}, see "[Running {% data variables.product.prodname_codeql_cli %} in your CI system](/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-cli-in-your-ci-system#viewing-log-and-diagnostic-information)."
|
||||
|
||||
### About summary metrics
|
||||
|
||||
{% data reusables.code-scanning.summary-metrics %}
|
||||
|
||||
### About {% data variables.product.prodname_codeql %} source code extraction diagnostics
|
||||
|
||||
{% data reusables.code-scanning.extractor-diagnostics %}
|
||||
|
||||
{% endif %}
|
||||
## Viewing the logging output from {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
This section applies to {% data variables.product.prodname_code_scanning %} run using {% data variables.product.prodname_actions %} ({% data variables.product.prodname_codeql %} or third-party).
|
||||
|
||||
After setting up {% data variables.product.prodname_code_scanning %} for your repository, you can watch the output of the actions as they run.
|
||||
|
||||
{% data reusables.repositories.actions-tab %}
|
||||
|
||||
You'll see a list that includes an entry for running the {% data variables.product.prodname_code_scanning %} workflow. The text of the entry is the title you gave your commit message.
|
||||
|
||||
|
||||
|
||||
1. Click the entry for the {% data variables.product.prodname_code_scanning %} workflow.
|
||||
|
||||
2. Click the job name on the left. For example, **Analyze (LANGUAGE)**.
|
||||
|
||||
|
||||
|
||||
1. Review the logging output from the actions in this workflow as they run.
|
||||
|
||||
1. Once all jobs are complete, you can view the details of any {% data variables.product.prodname_code_scanning %} alerts that were identified. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/code-security/secure-coding/managing-code-scanning-alerts-for-your-repository#viewing-the-alerts-for-a-repository)."
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** If you raised a pull request to add the {% data variables.product.prodname_code_scanning %} workflow to the repository, alerts from that pull request aren't displayed directly on the {% data variables.product.prodname_code_scanning_capc %} page until the pull request is merged. If any alerts were found you can view these, before the pull request is merged, by clicking the **_n_ alerts found** link in the banner on the {% data variables.product.prodname_code_scanning_capc %} page.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1"%}
|
||||
|
||||
{% else %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% endnote %}
|
||||
|
|
@ -263,11 +263,13 @@ echo $UPLOAD_TOKEN | codeql github upload-results --repository=my-org/example-re
|
|||
|
||||
## Troubleshooting the {% data variables.product.prodname_codeql_cli %} in your CI system
|
||||
|
||||
### Diagnostic data and summary metrics
|
||||
### Viewing log and diagnostic information
|
||||
|
||||
When you analyze a {% data variables.product.prodname_codeql %} database using a {% data variables.product.prodname_code_scanning %} query suite, in addition to generating detailed information about alerts, the CLI reports diagnostic data from the database generation step and summary metrics. For repositories with few alerts, you may find this information useful for determining if there are genuinely few problems in the code, or if there were errors generating the {% data variables.product.prodname_codeql %} database. For more detailed output from `codeql database analyze`, use the `--verbose` option.
|
||||
|
||||
### {% data variables.product.prodname_code_scanning %} only shows analysis results from one of the analized languages
|
||||
For more information about the type of diagnostic information available, see "[Viewing {% data variables.product.prodname_code_scanning %} logs](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/viewing-code-scanning-logs#about-analysis-and-diagnostic-information)".
|
||||
|
||||
### {% data variables.product.prodname_code_scanning_capc %} only shows analysis results from one of the analyzed languages
|
||||
|
||||
By default, {% data variables.product.prodname_code_scanning %} expects one SARIF results file per analysis for a repository. Consequently, when you upload a second SARIF results file for a commit, it is treated as a replacement for the original set of data.
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
Extractor diagnostics only cover files that were seen during the analysis, metrics include:
|
||||
- Number of files successfully analyzed
|
||||
- Number of files that generated extractor errors during database creation
|
||||
- Number of files that generated extractor warnings during database creation
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
Summary metrics include:
|
||||
|
||||
- Lines of code in the codebase (used as a baseline), before creation and extraction of the {% data variables.product.prodname_codeql %} database
|
||||
- Lines of code in the {% data variables.product.prodname_codeql %} database extracted from the code, including external libraries and auto-generated files
|
||||
- Lines of code in the {% data variables.product.prodname_codeql %} database excluding auto-generated files and external libraries
|
||||
Загрузка…
Ссылка в новой задаче