How to disable particular rule by its ID from GitHub workflow?

Sorry but I did not find the answer in docs. For example, I want to disable cs/linq/missed-where.

There is no simple way to do this. You could create a custom query suite. In your workflow's codeql init step, you would specify a config file to use:

- uses: github/codeql-action/init@v1
  with:
    config-file: ./.github/codeql/codeql-config.yml

And then in the config file, you specify custom queries:

disable-default-queries: true
queries:
  - uses: ./github/codeql/suite.qls

And finally, you need to create the query suite itself:

- from: codeql/csharp-queries
  apply: codeql-suites/csharp-security-and-quality.qls
- exclude:
    query filename: MissedWhereOpportunity.ql

Using this, you will have control over exactly which queries you want to run.

Understandable but I know the opposite - what queries I don't want to run, i.e. opt-out behavior instead of opt-in.

I see a lof of false positives (actually all results in case of aforementioned rule) and I want to disable this particular rule and continue to review security report.

With the above suggestion, you can choose to remove any single query from analysis.

Alternatively, if you just want to focus on security queries, you may just want to run security-extended queries. Just change: queries: security-and-quality to queries: security-extended.

I understand, thanks for your explanation, but I don't want to bother with manually crafted query suites (and their combinations) and maintain them updating to be in-sync with source. Please consider adding an option in workflows to exclude particular rules.

Thank you for your suggestion. We will keep this under consideration.

Will be fixed here: github/codeql-action#1098

Available in next release of the codeql-action. Documentation still to come.

Thanks.

@aeisenberg

So you have to create a separate file just to disable / exclude a query - @aeisenberg ?

That's correct. We might consider alternate syntaxes later, but this is the current behaviour.

[Lint] Add bat version and lint CI permission (#132)

@aeisenberg

@aeisenberg Hi, what is the current status of this issue? I see #1127 that reverts something, but I did not understand what exactly. So how can I disable particular rule for now?

This has been implemented using a feature called query filters. See the docs. https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning#excluding-specific-queries-from-analysis

Probably I do it wrong in graphql-dotnet/parser#301.

https://github.com/graphql-dotnet/parser/actions/runs/4728548769/jobs/8390195457?pr=301 :

Error: Invalid query filter.
Query filter must have exactly one key: {"exclude":null,"id":"cs/linq/missed-where"}

https://github.com/graphql-dotnet/parser/actions/runs/4728592373/jobs/8390280163?pr=301

Error: Invalid query filter.
Query filter must have exactly one key: {"exclude":null,"id":["cs/linq/missed-where"]}

See my commenton your PR.

Thanks.

Navigation Menu

Repository navigation

How to disable particular rule by its ID from GitHub workflow? #7937

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

How to disable particular rule by its ID from GitHub workflow? #7937

Description

Activity

aeisenberg commented on Feb 10, 2022

sungam3r commented on Feb 10, 2022

sungam3r commented on Feb 10, 2022

aeisenberg commented on Feb 11, 2022

sungam3r commented on Feb 11, 2022

aeisenberg commented on Feb 11, 2022

aeisenberg commented on Jun 15, 2022

aeisenberg commented on Jun 16, 2022

sungam3r commented on Jun 18, 2022

scherersebastian commented on Sep 12, 2022

aeisenberg commented on Sep 12, 2022

sungam3r commented on Apr 14, 2023

aeisenberg commented on Apr 14, 2023

sungam3r commented on Apr 18, 2023

aeisenberg commented on Apr 18, 2023

sungam3r commented on Apr 19, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions