Skip to content

Commit 3fee620

Browse files
GeekMasherGeekMasher
authored
Merge pull request #44 from GitHubSecurityLab/repo-updates
Update Repo
2 parents c9c6733 + 2f38835 commit 3fee620

File tree

10 files changed

+1465
-1
lines changed

10 files changed

+1465
-1
lines changed

‎.github/ISSUE_TEMPLATE/bug-report.yml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
name: Bug Report
2+
description: Report an issue with the CodeQL Bicep extractor or queries
3+
title: "[Bug]: "
4+
labels: ["bug", "triage", "needs-investigation"]
5+
assignees:
6+
- GeekMasher
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thanks for taking the time to fill out this bug report!
12+
13+
Complete and detailed bug reports help us identify issues faster and improve the CodeQL Bicep extractor and queries. Please provide as much relevant information as possible.
14+
- type: dropdown
15+
id: bug-type
16+
attributes:
17+
label: Bug Type
18+
description: What component of the Bicep CodeQL system is affected?
19+
options:
20+
- Extractor (code parsing/analysis)
21+
- Query (false positive/negative)
22+
- Database generation
23+
- Performance issue
24+
- Documentation
25+
- Other
26+
default: 0
27+
validations:
28+
required: true
29+
30+
- type: textarea
31+
id: what-happened
32+
attributes:
33+
label: Bug Description
34+
description: Please provide a clear description of the bug, including what you expected to happen and what actually happened
35+
placeholder: Describe the issue in detail...
36+
value: "When running the PHP extractor on my codebase, I encountered the following issue:"
37+
validations:
38+
required: true
39+
- type: input
40+
id: version
41+
attributes:
42+
label: CodeQL Version
43+
description: What version of CodeQL are you running?
44+
placeholder: e.g., 2.15.4, 3.0.0, etc.
45+
validations:
46+
required: true
47+
48+
- type: input
49+
id: bicep-version
50+
attributes:
51+
label: Bicep Version
52+
description: What version of Bicep is in your codebase?
53+
placeholder: e.g., 0.18.4, 0.20.0, etc.
54+
validations:
55+
required: false
56+
- type: dropdown
57+
id: environment
58+
attributes:
59+
label: Execution Environment
60+
description: Where are you running the CodeQL PHP extractor?
61+
multiple: true
62+
options:
63+
- GitHub Actions
64+
- CodeQL CLI
65+
- VS Code CodeQL extension
66+
- GitHub Code Scanning
67+
- Custom CI pipeline
68+
- Other
69+
- type: textarea
70+
id: reproduction-steps
71+
attributes:
72+
label: Steps to Reproduce
73+
description: Please provide detailed steps to reproduce the issue
74+
placeholder: |
75+
1. Run command '...'
76+
2. Open file '...'
77+
3. See error '...'
78+
value: "1. \n2. \n3. "
79+
validations:
80+
required: true
81+
82+
- type: textarea
83+
id: code-sample
84+
attributes:
85+
label: Minimal Code Sample
86+
description: If applicable, provide a minimal code sample that demonstrates the issue (with sensitive data removed)
87+
placeholder: |
88+
// Example Bicep code that triggers the issue
89+
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
90+
name: 'mystorage'
91+
location: 'eastus'
92+
// ...
93+
}
94+
render: bicep
95+
validations:
96+
required: false
97+
98+
- type: textarea
99+
id: logs
100+
attributes:
101+
label: Log Output
102+
description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
103+
placeholder: Copy error messages, stack traces, or other relevant logs here
104+
render: shell
105+
106+
- type: dropdown
107+
id: operating-system
108+
attributes:
109+
label: Operating System
110+
description: Which operating system are you using?
111+
options:
112+
- Windows
113+
- macOS
114+
- Linux
115+
- Other
116+
validations:
117+
required: false
118+
119+
- type: textarea
120+
id: additional-context
121+
attributes:
122+
label: Additional Context
123+
description: Add any other context about the problem here
124+
placeholder: Any other information that might be helpful, such as framework/library versions, related issues, etc.
125+
validations:
126+
required: false
127+
128+
- type: checkboxes
129+
id: terms
130+
attributes:
131+
label: Code of Conduct
132+
description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/advanced-security/policy-as-code/blob/main/CODE_OF_CONDUCT.md)
133+
options:
134+
- label: I agree to follow this project's Code of Conduct
135+
required: true

‎.github/ISSUE_TEMPLATE/framework.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Request Framework Support
2+
description: Request support for a new Bicep framework in CodeQL
3+
title: "[Framework]: "
4+
labels: ["feature", "enhancement", "framework"]
5+
assignees:
6+
- GeekMasher
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thanks for taking the time to fill out this framework support request! Adding support for Bicep frameworks helps improve the quality and coverage of CodeQL analysis.
12+
- type: dropdown
13+
id: framework-type
14+
attributes:
15+
label: Framework Type
16+
description: What type of Bicep framework are you requesting support for?
17+
options:
18+
- Azure Service Framework (e.g., AKS, App Service)
19+
- Infrastructure Pattern (e.g., Hub-Spoke, Landing Zone)
20+
- Module Collection (e.g., Azure Verified Modules)
21+
- Template Library (e.g., Bicep Registry)
22+
- Other
23+
default: 0
24+
validations:
25+
required: true
26+
27+
- type: textarea
28+
id: framework-info
29+
attributes:
30+
label: Framework Information
31+
description: Please provide details about the framework you want supported
32+
placeholder: Framework name, version, GitHub repository link, etc.
33+
value: "Framework: \nVersion: \nWebsite/Repo: "
34+
validations:
35+
required: true
36+
37+
- type: textarea
38+
id: security-features
39+
attributes:
40+
label: Security Features
41+
description: Please describe any security features or patterns specific to this framework that would benefit from CodeQL analysis
42+
placeholder: Security mechanisms, authentication systems, CSRF protection, etc.
43+
value: "Security features in this framework include:"
44+
validations:
45+
required: false
46+
47+
- type: textarea
48+
id: example-code
49+
attributes:
50+
label: Example Code
51+
description: Please provide example code snippets that show how the framework is typically used
52+
placeholder: Framework-specific code examples (resources, modules, parameters, etc.)
53+
value: "```bicep\n// Example framework usage\n```"
54+
validations:
55+
required: false
56+
57+
- type: textarea
58+
id: vulnerable-patterns
59+
attributes:
60+
label: Known Vulnerable Patterns
61+
description: If you're aware of any security vulnerabilities or problematic patterns specific to this framework, please describe them
62+
placeholder: Common misconfigurations, known CVEs, typical security issues...
63+
value: "Common vulnerability patterns include:"
64+
validations:
65+
required: false
66+
67+
- type: checkboxes
68+
id: terms
69+
attributes:
70+
label: Code of Conduct
71+
description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/advanced-security/policy-as-code/blob/main/CODE_OF_CONDUCT.md)
72+
options:
73+
- label: I agree to follow this project's Code of Conduct
74+
required: true

‎.github/ISSUE_TEMPLATE/library.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Request CodeQL Library Feature
2+
description: Request a new feature or enhancement for the Bicep CodeQL library
3+
title: "[Library]: "
4+
labels: ["feature", "enhancement", "library"]
5+
assignees:
6+
- GeekMasher
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thanks for taking the time to fill out this CodeQL library feature request! Enhancing the Bicep CodeQL library helps improve the quality and coverage of static analysis.
12+
- type: dropdown
13+
id: library-component
14+
attributes:
15+
label: Library Component(s)
16+
description: Which CodeQL library component(s) does this feature request relate to? (Select all that apply)
17+
options:
18+
- AST (Abstract Syntax Tree)
19+
- CFG (Control Flow Graph)
20+
- Dataflow / TaintTracking
21+
- ApiGraph
22+
- TypeTracking
23+
- Framework Support
24+
- Security Analysis
25+
- Other
26+
multiple: true
27+
default: 0
28+
validations:
29+
required: true
30+
31+
- type: textarea
32+
id: feature-description
33+
attributes:
34+
label: Feature Description
35+
description: Please provide a detailed description of the feature or enhancement you're requesting
36+
placeholder: Explain what functionality you need and why it's important
37+
value: "Feature: \nUse case: \nImportance: "
38+
validations:
39+
required: true
40+
41+
- type: textarea
42+
id: technical-details
43+
attributes:
44+
label: Technical Details
45+
description: Please provide any relevant technical details about the feature request
46+
placeholder: Implementation ideas, related CodeQL concepts, links to documentation, etc.
47+
value: "Technical implementation details:"
48+
validations:
49+
required: false
50+
51+
- type: textarea
52+
id: example-code
53+
attributes:
54+
label: Example Code
55+
description: Please provide Bicep code examples that demonstrate the functionality you're requesting
56+
placeholder: Bicep code that illustrates the patterns you want to analyze
57+
value: "```bicep\n// Example Bicep code that should be analyzed\n```"
58+
validations:
59+
required: false
60+
61+
- type: textarea
62+
id: example-query
63+
attributes:
64+
label: Example Query
65+
description: If applicable, please provide an example CodeQL query that would use this feature
66+
placeholder: A sketch of a CodeQL query that would benefit from this feature
67+
value: "```ql\n// Example CodeQL query using the requested feature\n```"
68+
validations:
69+
required: false
70+
71+
- type: textarea
72+
id: benefits
73+
attributes:
74+
label: Expected Benefits
75+
description: Please describe how this feature would improve the PHP CodeQL library
76+
placeholder: Improved analysis accuracy, new detection capabilities, performance benefits...
77+
value: "This feature would benefit CodeQL analysis by:"
78+
validations:
79+
required: false
80+
81+
- type: checkboxes
82+
id: terms
83+
attributes:
84+
label: Code of Conduct
85+
description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/advanced-security/policy-as-code/blob/main/CODE_OF_CONDUCT.md)
86+
options:
87+
- label: I agree to follow this project's Code of Conduct
88+
required: true

‎.github/ISSUE_TEMPLATE/query.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: Request new CodeQL Query
2+
description: Request a new Bicep analysis query for the CodeQL library
3+
title: "[Query]: "
4+
labels: ["feature", "enhancement", "query"]
5+
assignees:
6+
- GeekMasher
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thanks for taking the time to fill out this query request!
12+
13+
CodeQL queries help identify security vulnerabilities, bugs, and quality issues in Bicep code. Providing detailed information will help us create effective queries that address real-world needs.
14+
- type: dropdown
15+
id: query-type
16+
attributes:
17+
label: Query Type
18+
description: What type of query are you requesting?
19+
options:
20+
- Security
21+
- Performance Optimization
22+
- Code Quality
23+
- Maintainability
24+
- Bug Detection
25+
- Framework-specific Issues
26+
- Other
27+
default: 0
28+
validations:
29+
required: true
30+
31+
- type: textarea
32+
id: description
33+
attributes:
34+
label: Query Description
35+
description: Please provide a clear description of the query you want to create
36+
placeholder: Describe the issue this query should detect...
37+
value: "This query should identify the following issue(s):"
38+
validations:
39+
required: true
40+
41+
- type: dropdown
42+
id: query-severity
43+
attributes:
44+
label: Expected Severity
45+
description: What is the expected severity level of issues found by this query?
46+
options:
47+
- Critical
48+
- High
49+
- Medium
50+
- Low
51+
- Informational
52+
default: 2
53+
validations:
54+
required: true
55+
56+
- type: textarea
57+
id: examples
58+
attributes:
59+
label: Code Example
60+
description: Provide an example
61+
placeholder: Example of vulnerabilities or issues this query should detect
62+
value: "```bicep\n// Code example\n```"
63+
validations:
64+
required: false
65+
66+
- type: input
67+
id: references
68+
attributes:
69+
label: References
70+
description: Links to CVEs, research papers, articles, or other resources that describe this issue
71+
placeholder: "e.g., https://cve.mitre.org/..."
72+
validations:
73+
required: false
74+
75+
- type: checkboxes
76+
id: terms
77+
attributes:
78+
label: Code of Conduct
79+
description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/advanced-security/policy-as-code/blob/main/CODE_OF_CONDUCT.md)
80+
options:
81+
- label: I agree to follow this project's Code of Conduct
82+
required: true

0 commit comments

Comments
 (0)