Pass the matrix language to CodeQL under the name it reads - #76
Merged
Conversation
`codeql-action/init` takes `languages`, not `language`. Every run has been saying
so and nobody was reading it:
Unexpected input(s) 'language', valid inputs are ['tools', 'languages', ...]
Because the input was ignored, the `[csharp, actions]` matrix was not selecting
anything: both legs fell back to autodetection and analysed whatever CodeQL
inferred, twice. The matrix has been decorative since it was written.
One word. It makes the two legs analyse csharp and actions as the file already
claims they do, and it removes a warning from every security run. Expect the
Actions leg in particular to have more to say now that it is actually being
asked about Actions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
codeql-action/inittakeslanguages, notlanguage. Every run has been saying so in an annotation nobody was reading:Because the input was ignored, the
[csharp, actions]matrix was not selecting anything — both legs fell back to autodetection and analysed whatever CodeQL inferred, twice over. The matrix has been decorative since it was written, which is a quiet way for a security workflow to do less than it appears to.One word. The two legs now analyse
csharpandactionsas the file already claims, and the warning goes away.Expect this to surface findings, particularly on the Actions leg, which has never actually been asked about Actions before. That is the point of the fix rather than a side effect of it.
Found while clearing the Dependabot backlog: the annotation was sitting next to the codeql-action version-mismatch failures.