codeql-action icon indicating copy to clipboard operation
codeql-action copied to clipboard

Unable to run custom queries against GitHub Actions

Open billnapier opened this issue 10 months ago • 1 comments

I've been trying to use codeql to check my GitHub Actions workflows. I've got it kinda working here:

https://github.com/billnapier/github-actions-check-workflow/pulls

I can test things, and when I run codeql standalone, stuff works just fine:

codeql database create --force-overwrite --db-cluster /workspaces/c 
--source-root=/workspaces/github-actions-check-workflow --calculate-language-specific-baseline --extractor-include-aliases --sublanguage-file-
coverage --language=actions --search-path /workspaces/codeql-action --build-mode=none

and then run the query:

codeql query run --database /workspaces/c/actions -- actions-queries/pull_request_target.ql

So my query is well formed, and I can generate the DB. But when I try and run it via Actions, I get this output instead (also in the PR):

Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.20.3/x64/codeql/codeql database init --force-overwrite --db-cluster /home/runner/work/_temp/codeql_databases --source-root=/home/runner/work/github-actions-check-workflow/github-actions-check-workflow --calculate-language-specific-baseline --extractor-include-aliases --sublanguage-file-coverage --language=actions --search-path /home/runner/work/_actions/github/codeql-action/v3/actions-extractor --codescanning-config=/home/runner/work/_temp/user-config.yaml --build-mode=none". Exit code was 2 and error was: A fatal error occurred: No queries defined for actions. See the logs for more details.

I've been trying to debug the "No queries defined for actions", but I'm stumped. I'm guessing that I'm missing something specifying what language my query is used for, but I have no idea what I'm missing.

billnapier avatar Feb 05 '25 17:02 billnapier

actions-queries/pull_request_target.ql is importing javascript. I believe you need to import actions. I'm not sure what the equivalent of import semmle.javascript.Actions should be, but it will be something in the actions-all pack.

aeisenberg avatar Feb 05 '25 20:02 aeisenberg