{"id":19652680,"url":"https://github.com/advanced-security/monorepo-filtering-workaround","last_synced_at":"2025-04-28T17:30:46.288Z","repository":{"id":162292757,"uuid":"635858246","full_name":"advanced-security/monorepo-filtering-workaround","owner":"advanced-security","description":"A monorepo filtering workaround for GitHub Advanced Security Code Scanning using renaming of the scanning tool in an Actions workflow","archived":false,"fork":false,"pushed_at":"2025-03-24T20:24:24.000Z","size":97,"stargazers_count":10,"open_issues_count":3,"forks_count":6,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-05T10:01:34.319Z","etag":null,"topics":["actions-workflow","advanced-security","code-scanning","codeql","ghas","monorepo","sarif","sast"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/advanced-security.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-03T15:49:04.000Z","updated_at":"2024-09-13T16:50:06.000Z","dependencies_parsed_at":null,"dependency_job_id":"dba2306f-8689-4cb1-b14d-52e7ba86bc24","html_url":"https://github.com/advanced-security/monorepo-filtering-workaround","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/advanced-security%2Fmonorepo-filtering-workaround","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/advanced-security%2Fmonorepo-filtering-workaround/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/advanced-security%2Fmonorepo-filtering-workaround/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/advanced-security%2Fmonorepo-filtering-workaround/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/advanced-security","download_url":"https://codeload.github.com/advanced-security/monorepo-filtering-workaround/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251355241,"owners_count":21576321,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["actions-workflow","advanced-security","code-scanning","codeql","ghas","monorepo","sarif","sast"],"created_at":"2024-11-11T15:11:44.102Z","updated_at":"2025-04-28T17:30:46.009Z","avatar_url":"https://github.com/advanced-security.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Monorepo workflow for GitHub Advanced Security Code Scanning\n\n\u003e [!NOTE]\n\u003e This is an _unofficial_ project created by Field Security Services, and is not officially supported by GitHub.\n\n\u003e [!WARNING]\n\u003e This method renames the CodeQL tool in the results, which breaks CodeQL Autofix and may affect other features of Code Scanning\n\nThis sample GitHub Actions workflow shows you how to enable filtering results from different GitHub Advanced Security Code Scanning runs in the GitHub UI using a workaround.\n\nThis is useful when dealing with monorepos that have code for several different projects in the same repository.\n\nYou can use this workflow modification to mark each project with a unique scanning tool name, and then filter the results in the GitHub Security tab by that tool to only show results for a specific project.\n\nThe SARIF (the format for the code scanning results) is edited before upload to Code Scanning, changing the tool name. CodeQL is also set up so that the content of the SARIF populates the Code Scanning UI correctly.\n\nThe unique tool name can then be used to filter results in the web user interface:\n\n![Filtering results by tool name](./filter-by-tool-name.png)\n\n\u003e [!NOTE]\n\u003e This is an _unofficial_ project created by Field Security Services, and is not officially supported by GitHub.\n\n\u003e [!WARNING]\n\u003e This method renames the CodeQL tool in the results, which breaks CodeQL Autofix and may affect other features of Code Scanning\n\n## Usage\n\nTo use this workaround, you need to make some modifications to your Actions workflow file that runs CodeQL.\n\nThis example uses a monorepo with Java code, but you can adapt it to your own monorepo.\n\n### The changes in isolation\n\nChange the typical `analyze` step from:\n\n```yaml\n    - name: Perform CodeQL Analysis\n      uses: github/codeql-action/analyze@v2\n      with:\n        category: \"/language:${{matrix.language}}\"\n```\n\nto:\n\n```yaml\n    - name: Perform CodeQL Analysis\n      uses: github/codeql-action/analyze@v2\n      with:\n        category: \"/language:${{matrix.language}}\"\n        upload: False\n        output: sarif-results\n      env:\n      # https://codeql.github.com/docs/codeql-cli/manual/database-analyze/#options\n      # add code snippet, query help and group rules by pack, to the SARIF file\n        CODEQL_ACTION_EXTRA_OPTIONS: '{\"database\":{\"analyze\":[\"--sarif-add-snippets\",\"--sarif-add-query-help\",\"--sarif-group-rules-by-pack\"]}}'\n\n    # Rename CodeQL tool to allow filtering by workflow in Code Scanning\n    - name: Rename CodeQL tool\n      run: |\n        jq \".runs[0].tool.driver.name = \\\"CodeQL-${WORKFLOW_TAG}-${{matrix.language}}\\\"\" sarif-results/${{ matrix.language }}.sarif \u003e sarif-results/${{ matrix.language }}-edited.sarif\n      env:\n        # edit this tag to something unique to your workflow\n        WORKFLOW_TAG: \"some-unique-tag\"  # this will name the tool 'CodeQL-some-unique-tag-java'\n\n    # Upload the CodeQL Analysis results\n    - name: Upload SARIF\n      uses: github/codeql-action/upload-sarif@v2\n      with:\n        sarif_file: sarif-results/${{ matrix.language }}-edited.sarif\n```\n\nThis will rename the CodeQL tool in the SARIF file to include the workflow tag, and uploads the SARIF file to Code Scanning.\n\nThe `analyze` step has some changes to ensure that the CodeQL results are displayed properly in the GitHub Advcanced Security UI.\n\n### Full example workflow file\n\nSee [`codeql_sample_workflow.yml`](codeql_sample_workflow.yml).\n\nThis repo also contains a very basic monorepo to show it in action on a \"real\" repo.\n\n## Requirements\n\n* GitHub Actions with `jq` on the runner (included by default on the standard GitHub hosted runners)\n* GitHub Advanced Security for private GitHub Enterprise repositories, or a public repository\n* GitHub.com or GitHub Enterprise Server\n\n## License\n\nThis project is licensed under the terms of the MIT open source license. Please refer to the [LICENSE](LICENSE) for the full terms.\n\n## Maintainers\n\nSee [CODEOWNERS](CODEOWNERS) for the list of maintainers.\n\n## Support\n\nSee the [SUPPORT](SUPPORT.md) file.\n\n## Background\n\nSee the [CHANGELOG](CHANGELOG.md), [CONTRIBUTING](CONTRIBUTING.md), [SECURITY](SECURITY.md), [SUPPORT](SUPPORT.md), [CODE OF CONDUCT](CODE_OF_CONDUCT.md) and [PRIVACY](PRIVACY.md) files for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadvanced-security%2Fmonorepo-filtering-workaround","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fadvanced-security%2Fmonorepo-filtering-workaround","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fadvanced-security%2Fmonorepo-filtering-workaround/lists"}