GitHub Advanced Security now supports the ability to analyze your code for semantic vulnerabilities from within your third-party CI pipelines. Previously, this capability was available exclusively with GitHub Actions. In this post, I will walk you through a simple implementation of GitHub Advanced Security Code Scanning in an Azure DevOps CI pipeline with a node application using the YAML editor. The Code Scanning results will resurface after the scan back in your GitHub repository under the Security tab for your developers to review and remediate.

If your organization does not have GitHub Advanced Security enabled, you will not see “Code scanning alerts” or “Detected secrets”.

Rather than leveraging the native GitHub Actions workflow with the standard “Set Up Workflow” experience we are going to use an Azure DevOps pipeline.

Navigate to your Azure DevOps pipeline to begin integrating CodeQL.

The Azure Pipelines Agent I am using is ephemeral so I install the CodeQl package on each pipeline execution. With a self hosted agent consider pre-installing the package to save time and compute resources.

Integrating GitHub Advanced Security for code scanning

Integration Steps:

1. Download the latest CodeQL dependencies on your agent.
2. Give CodeQL access to your repository.
3. Initialize the CodeQL executable and create a queryable DB.
4. Scan your application.
5. Upload results to GitHub.
6. Review your results.
7. Customize your scan further.

Downloading the latest CodeQL dependencies on my agent

Using wget and targeting the latest Linux release I can download all necessary files to a new codeql directory. I also change permissions for the downloaded file before I run it.

I added the following script to the bottom of my pipeline:

- script: |
   wget https://github.com/github/codeql-action/releases/latest/download/codeql-runner-linux
   chmod +x codeql-runner-linux
 displayName: 'Get latest CodeQL package. Install on Agent.'

Give the utility access to your repository

Create a Personal Access Token or use GitHub Apps for authentication. I am using a PAT and saving it as a pipeline variable as $GITHUB_PAT.

Initialize the CodeQ Executable and create a CodeQL database for the language detected.

I added the following script to the bottom of my pipeline:

- script: |
   ./codeql-runner-linux init --repository octodemo/ghas-azure-devops-code-scanning --github-url https://github.com --github-auth $GITHUB_PAT
 displayName: 'Initialize CodeQL Executable and create a CodeQL database'

Now I want to populate the CodeQL runner databases, analyze them, and upload the results to GitHub.

I added the following script to the bottom of my pipeline:

- script: |
   ./codeql-runner-linux analyze --repository octodemo/ghas-azure-devops-code-scanning --github-url https://github.com --github-auth $GITHUB_PAT --commit 92065de8b22bbfeda511d12571b66c9969ff593b --ref refs/heads/master
 displayName: 'Populate the CodeQL runner databases, analyze them, and upload the results to GitHub.'

#product #security