gregnrobinson/codeql-cli repository overview

FROM ubuntu:20.04

# tzdata install needs to be non-interactive
ENV DEBIAN_FRONTEND=noninteractive

# install/update basics and python
RUN apt update

RUN apt-get install -y \
    software-properties-common \
    vim \
    curl \
    wget \
    git \
    build-essential \
    unzip \
    apt-transport-https \
    python3.8 \
    python3-venv \
    python3-pip \
    python3-setuptools \
    python3-dev \
    gnupg \
    g++ \
    make \
    gcc \
    apt-utils \
    rsync \
    file \
    dos2unix \
    gettext && \
    apt-get clean && \
    rm -f /usr/bin/python /usr/bin/pip && \
    ln -s /usr/bin/python3.8 /usr/bin/python && \
    ln -s /usr/bin/pip3 /usr/bin/pip

# Install latest codeQL
ENV CODEQL_HOME /usr/local/codeql-home
RUN mkdir -p ${CODEQL_HOME}

RUN wget -O codeql-bundle.tar.gz https://github.com/github/codeql-action/releases/download/codeql-bundle-20211025/codeql-bundle.tar.gz &&\
    tar -xvzf codeql-bundle.tar.gz &&\
    cp -R ./codeql ${CODEQL_HOME}

ENV PATH="${CODEQL_HOME}/codeql:${PATH}"

ENV PYTHONIOENCODING=utf-8
ENTRYPOINT ["codeql"]

cat <<EOF | kubectl create -f -
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: codeql
spec:
  params:
    - name: BUILD_IMAGE
      default: docker.io/gregnrobinson/codeql-cli:latest
      description: Reference of the image buildah will produce.
    - name: CONTEXT
      description: Path to codeql source code.
      default: .
    - name: GITHUB_TOKEN
      description: A Github PAT with repo access.
      default: tkn-github-token
    - name: REPO
      description: Repo short form name.
    - name: REPO_URL
      description: Full clone Url.
    - name: LANGUAGE
      description: CodeQL language to scan. 
      default: javascript
  workspaces:
    - name: source
      description: |
        Shared workspace including the repo source code.
  steps:
    - name: codeql-resolve-packs
      image: $(params.BUILD_IMAGE)
      workingDir: $(workspaces.source.path)
      script: |
        codeql resolve languages &&\
        codeql resolve qlpacks
    - name: codeql-create-db
      resources:
        requests:
          memory: 2Gi
          cpu: 600m
        limits:
          memory: 4Gi
          cpu: 900m
      image: $(params.BUILD_IMAGE)
      workingDir: $(workspaces.source.path)
      script: |
        codeql database create \
          --language=$(params.LANGUAGE) /workspace/source/$(params.LANGUAGE)-db
    - name: codeql-analyze-db
      resources:
        requests:
          memory: 2Gi
          cpu: 800m
        limits:
          memory: 4Gi
          cpu: 900m
      image: $(params.BUILD_IMAGE)
      workingDir: $(workspaces.source.path)
      script: |
        codeql database analyze /workspace/source/$(params.LANGUAGE)-db --format=sarif-latest --output=/workspace/source/$(params.LANGUAGE)-results
        codeql github upload-results --repository=$(params.REPO) --ref=refs/heads/main --sarif=/workspace/source/$(params.LANGUAGE)-results
      env:
        - name: GITHUB_TOKEN
          valueFrom:
            secretKeyRef:
              name: $(params.GITHUB_TOKEN)
              key: secretToken
EOF

cat <<EOF | kubectl create -f -
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: codeql
spec:
  workspaces:
    - name: shared-data
      description: |
        This workspace will receive the cloned git repo and be passed
        to the next Task for the repo's README.md file to be read.
    - name: ssh-creds
      description: |
        This workspace will provide ssh credentials to the git-clone task.
  params:
    - name: buildImageUrl
      type: string
      description: Name of App that will be deployed.
    - name: repoUrl
      type: string
      description: The git repository URL to clone from.
    - name: repo
      type: string
      description: The git repository name.
    - name: branchName
      type: string
      description: The git branch to clone.
    - name: pathToContext
      type: string
      description: Set current directory.
    - name: githubToken
      type: string
      description: Reference to the secret name storing the github PAT.
    - name: language
      type: string
      description: Language for CodeQL to scan.
  tasks:
    - name: fetch-repository
      taskRef:
        name: t-git-clone
      workspaces:
        - name: output
          workspace: shared-data
        - name: ssh-directory
          workspace: ssh-creds
      params:
        - name: url
          value: $(params.repoUrl)
        - name: deleteExisting
          value: "true"
        - name: revision
          value: $(params.branchName)
    - name: codeql-scan
      taskRef:
        name: t-codeql
      runAfter:
        - fetch-repository
      params:
        - name: BUILD_IMAGE
          value: $(params.buildImageUrl)
        - name: CONTEXT
          value: $(params.pathToContext)
        - name: GITHUB_TOKEN
          value: $(params.githubToken)
        - name: REPO
          value: $(params.repo)
        - name: REPO_URL
          value: $(params.repoUrl)
        - name: LANGUAGE
          value: $(params.language)
      workspaces:
        - name: source
          workspace: shared-data
EOF

cat <<EOF | kubectl create -f -
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  generateName: codeql-scan-run-
spec:
  pipelineRef:
    name: p-codeql
  params:
  - name: buildImageUrl
    value: docker.io/gregnrobinson/codeql-cli:latest
  - name: repoUrl
    value: [email protected]:bcgov/security-pipeline-templates.git
  - name: repo
    value: bcgov/security-pipeline-templates
  - name: branchName
    value: main
  - name: pathToContext
    value: .
  - name: githubToken
    value: tkn-github-token
  - name: language
    value: python
  workspaces:
  - name: shared-data
    volumeClaimTemplate:
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 1Gi
  - name: ssh-creds
    secret:
      secretName: tkn-ssh-credentials
  - name: docker-config
    secret:
      secretName: tkn-docker-credentials
EOF