Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/steps/1-codeql-language-matrix.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,23 +9,23 @@ CodeQL language matrices allow you to configure your CodeQL workflows with a lan
### Importance of using languages matrices with code scanning

1. **Simplicity**: Using a language matrix with CodeQL simplifies your workflow by allowing you to manage multiple languages in a single workflow file. This eliminates the need for separate workflows for each language, making your code scanning process more streamlined and manageable.
2. **Flexibility**: A language matrix provides flexibility as it allows you to easily add or remove languages from your workflow. This means you can quickly adapt your code scanning process to changes in your project's language usage.
2. **Flexibility**: A language matrix provides flexibility, as it allows you to easily add or remove languages from your workflow. This means you can quickly adapt your code scanning process to changes in your project's language usage.
3. **Consistency**: By using a language matrix, you ensure consistent code scanning across all languages used in your project. This helps maintain the quality and security of your codebase, regardless of the language it's written in.

Remember, a well-configured CodeQL setup is key to maintaining a secure and reliable codebase.

### :keyboard: Activity: Configure your `codeql.yml` file to use a language matrix

1. Navigate to the `Code` tab and locate the `.github/workflows` folder.
1. Add the following content to the `codeql.yml` file before the steps section:
1. In the `Code` tab, locate the `.github/workflows` folder.
1. In the `codeql.yml` file, above the `steps` section, add the following:
```yaml
strategy:
fail-fast: false
matrix:
language: [ 'go', 'java-kotlin', 'javascript-typescript', 'python' ]
# CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
# Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
# Use only 'java-kotlin' to analyze code written in Java, Kotlin, or both
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript, or both
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

```
Expand All @@ -35,7 +35,7 @@ Remember, a well-configured CodeQL setup is key to maintaining a secure and reli
with:
languages: ${{ matrix.language }}
```
1. Finally we need to add the language matrix to the CodeQL analyze action. Add the following to the CodeQL analyze action:
1. Finally, we need to add the language matrix to the CodeQL analyze action. Add the following to the CodeQL analyze action:
```yaml
with:
category: ${{ matrix.language }}
Expand Down
2 changes: 1 addition & 1 deletion .github/steps/2-codeql-autobuild.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

_Nice work! :tada: You modified your workflow to use a language matrix!_

With the language matrix specified we can see the languages that we want to scan. One of those languages is a compiled language, and as such will not work correctly with how we have the workflow set up. We need to make sure that the autobuild step is included _and_ only runs when it is needed.
With the language matrix specified we can see the languages we want to scan. One of those languages is a compiled language, and as such, will not work correctly with how we have the workflow set up. We need to make sure the autobuild step is included _and_ only runs when it is needed.

Autobuild for CodeQL is a feature that automatically attempts to build any compiled languages in your repository. It works by detecting the build system in your repository and executing the appropriate commands to compile the code, enabling CodeQL to analyze the compiled language.

Expand Down
2 changes: 1 addition & 1 deletion .github/steps/X-finish.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ _Congratulations friend, you've completed this course!_
Here's a recap of all the tasks you've accomplished in your repository:

- You've learned how to use a language matrix with CodeQL workflows.
- You've learned how about the CodeQL autobuild action works.
- You've learned about how the CodeQL autobuild action works.
- You've learned how to use contextual expressions.

### Additional learning and resources
Expand Down
6 changes: 3 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,12 @@ _Configure your CodeQL workflows with a language matrix to simplify your code sc

## Welcome

In this course we will explore how you can configure CodeQL using configuration files. During this course, we will show you how to add a query pack to a CodeQL configuration file as well as configure your workflow to reference that configuration file.
In this course we will explore how you can configure CodeQL using configuration files. During this course, we will show you how to add a query pack to a CodeQL configuration file, as well as configure your workflow to reference that configuration file.

- **Who is this for**: Developers, security engineers, open source maintainers.
- **What you'll learn**: We'll show you how to configure your workflow to use a language matrix. We will also cover the autobuild action for compiled langauges. This will allow you to have a single code scanning workflow that covers all the languages in your repository.
- **What you'll learn**: We'll show you how to configure your workflow to use a language matrix. We will also cover the autobuild action for compiled languages. This will allow you to have a single code scanning workflow that covers all the languages in your repository.
- **What you'll build**: A secure software development pipeline that has been tuned to your project's specific needs.
- **Prerequisites**: Knowledge of how the Context and expressions work in workflows. You can learn more about this in the [GitHub Actions documentation](https://docs.github.com/en/actions).
- **Prerequisites**: Knowledge of how the context and expressions work in workflows. You can learn more about this in the [GitHub Actions documentation](https://docs.github.com/en/actions).
- **How long**: This course is 2 steps long and takes less than 30 minutes to complete.

## How to start this course
Expand Down