You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
@@ -10,24 +9,26 @@ Contributions to this project are [released](https://help.github.com/articles/gi
10
9
11
10
Please note that this project is released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md). By participating in this project you agree to abide by its terms.
12
11
13
-
## Submitting a pull request
12
+
## Submitting a Pull Request
14
13
15
-
1.[Fork][fork] and clone the repository
16
-
1. Configure and install the [CodeQL CLI](https://github.com/github/codeql-cli-binaries/releases) specified in the `qlt.conf.json` file
17
-
1. Create a new branch: `git checkout -b my-branch-name`
18
-
1. Make your changes
19
-
1. Make sure the QL tests pass on your machine
20
-
1. Ensure the files are appropriately formatted (QL files should be formatted with `codeql query format`)
21
-
1. Push to your fork and [submit a draft pull request](https://github.com/advanced-security/codeql-sap-js/compare). Make sure to select **Create Draft Pull Request**.
22
-
7. Address failed checks, if any.
23
-
8. Mark the [pull request ready for review](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review).
24
-
9. Pat your self on the back and wait for your pull request to be reviewed and merged.
14
+
1.[Fork][fork] and clone the repository.
15
+
1. Configure and install the [CodeQL CLI](https://github.com/github/codeql-cli-binaries/releases) specified in the `qlt.conf.json` file.
16
+
1. Create a new branch: `git checkout -b my-branch-name`.
17
+
1. Make your changes.
18
+
1. Make sure the QL tests pass on your machine.
19
+
1. Ensure the files are appropriately formatted (QL files should be formatted with `codeql query format`).
20
+
1. Push to your fork and [submit a draft Pull Request](https://github.com/advanced-security/codeql-sap-js/compare). Make sure to select **Create Draft Pull Request**.
21
+
1. Address failed checks, if any.
22
+
1. Mark the [Pull Request ready for review](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-stage-of-a-pull-request#marking-a-pull-request-as-ready-for-review).
23
+
1. Pat yourself on the back and wait for your Pull Request to be reviewed and merged.
25
24
26
-
Here are a few things you can do that will increase the likelihood of your pull request being accepted:
25
+
## Helping Your Pull Request Get Accepted
26
+
27
+
Here are a few things you can do that will increase the likelihood of your Pull Request being accepted:
27
28
28
29
- Follow the [CodeQL style guide][style].
29
30
- Write good tests.
30
-
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate pull requests.
31
+
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as separate Pull Requests.
31
32
- Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
### Analyzing a repository with [Code Scanning](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-query-packs)
20
+
15
21
Example workflow file:
22
+
16
23
```yaml
17
24
jobs:
18
25
analyze-javascript:
@@ -45,7 +52,9 @@ jobs:
45
52
LGTM_INDEX_XML_MODE: all
46
53
LGTM_INDEX_FILETYPES: ".json:JSON\n.cds:JSON"
47
54
```
55
+
48
56
Example configuration file:
57
+
49
58
```yaml
50
59
name: "My CodeQL config"
51
60
@@ -60,15 +69,19 @@ packs:
60
69
paths-ignore:
61
70
- "**/node_modules"
62
71
```
72
+
63
73
### Building and analyzing the CodeQL database with the CodeQL CLI
64
74
65
75
1. Include and index XML, JSON and CDS files by setting the necessary environment variables:
### Example `codeql database create` with CDS Extractor Invocation
111
+
112
+
The following example invocation of `codeql database create` includes the `--command` option to invoke the CDS extractor as an extension of the `javascript` extractor, which is used by `codeql` to create the database. The `pre-finalize.sh` script is a minimal wrapper around the `codeql database index-files` command, which we expect to run the `extractors/cds/tools/index-files.js` script to index the JSON files pre-generated by the CDS extractor.
113
+
114
+
The below example assumes that:
115
+
116
+
- The [`SAP-samples/cloud-cap-samples`][cloud-cap-samples] repository has been cloned to a sibling directory of the one containing the this repository.
117
+
- The [`SAP-samples/cloud-cap-samples`][cloud-cap-samples] repository is intended as the source code root (i.e. target project) for the database.
118
+
- The database directory (e.g., `~/codeql-home/databases/cloud-cap-samples-real`) is either absent or empty.
- The `--source-root` option must be adjusted to match the actual location of the target project (e.g., GitHub repository).
132
+
- The database directory path (last argument) must be adjusted to match the desired location of the created database.
133
+
- Running the above command multiple times with the same database directory will result in an error. The `--overwrite` command-line option can be used to avoid this error.
134
+
- See `codeql database create -h -v` for verbose command help.
135
+
136
+
## License
94
137
95
138
This project is licensed under the terms of the MIT open source license. Please refer to [MIT](LICENSE.txt) for the full terms.
GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as [GitHub](https://github.com/GitHub).
6
6
7
-
Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation.
7
+
Even though [open source repositories are outside of the scope of our bug bounty program](https://bounty.github.com/index.html#scope) and therefore not eligible for bounty rewards, we will ensure that your finding gets passed along to the appropriate maintainers for remediation.
8
8
9
9
## Reporting Security Issues
10
10
@@ -16,16 +16,16 @@ Instead, please send an email to opensource-security[@]github.com.
16
16
17
17
Please include as much of the information listed below as you can to help us better understand and resolve the issue:
18
18
19
-
* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
20
-
* Full paths of source file(s) related to the manifestation of the issue
21
-
* The location of the affected source code (tag/branch/commit or direct URL)
22
-
* Any special configuration required to reproduce the issue
23
-
* Step-by-step instructions to reproduce the issue
24
-
* Proof-of-concept or exploit code (if possible)
25
-
* Impact of the issue, including how an attacker might exploit the issue
19
+
* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
20
+
* Full paths of source file(s) related to the manifestation of the issue
21
+
* The location of the affected source code (tag/branch/commit or direct URL)
22
+
* Any special configuration required to reproduce the issue
23
+
* Step-by-step instructions to reproduce the issue
24
+
* Proof-of-concept or exploit code (if possible)
25
+
* Impact of the issue, including how an attacker might exploit the issue
26
26
27
27
This information will help us triage your report more quickly.
28
28
29
29
## Policy
30
30
31
-
See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor#1-safe-harbor-terms)
31
+
See [GitHub's Safe Harbor Policy](https://docs.github.com/en/site-policy/security-policies/github-bug-bounty-program-legal-safe-harbor#1-safe-harbor-terms).
0 commit comments