advanced-security / codeql-bundle-action Goto Github PK

If you copy & paste the example "Build custom bundle" action from the readme into a new repository, the following error occurs:

Run advanced-security/codeql-bundle-action/download-bundle@v2
Run download-bundle/download-bundle.sh
/home/runner/work/_temp/xxxxxxxxx.sh: line 1: download-bundle/download-bundle.sh: No such file or directory
Error: Process completed with exit code 127.

Right now the Action pulls from the github/codeql-action repository. It would be great to be able to point to an external CodeQL bundle created by the community so that if a user wants to build on another bundle, you could specify it.

Solution

The values in the bundle.ts should come from the action.yml (default value is github/codeql-action).

- name: CodeQL bundle
    id: codeql-bundle
    uses: advanced-security/codeql-bundle-action@main
    with:
        packs: "geekmasher/python"
        bundle: advanced-security/codeql-queries
        # or a link?
        bundle: https://s3.amazonaws.com/<bucket>/<object>

This also helps if users store a version on CodeQL Bundle already in GitHub Packages, S3 bucket, Artifactory, etc.

Suggestions for other solutions are welcome too.

The bundle action currently customizes the multi-platform bundle. This ensures the customized bundle is compatible with all supported platforms, but does mean the customized bundle is larger than necessary.

We should add an option to fetch and generate platform specific bundles, so that we can minimize the deployment size.