Skip to content

Commit 01364e6

Browse files
antonychiu2antonychiu2
authored
Merge pull request #5 from mobb-dev/fix-mobb-url
Fix mobb url
2 parents 7866554 + 378db48 commit 01364e6

2 files changed

Lines changed: 167 additions & 37 deletions

File tree

‎README.md‎

Lines changed: 63 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,32 @@
22

33
## Overview
44

5-
This action is used alongside the native CodeQL Code Scanning feature to monitor for the completion of a CodeQL scan within a Pull Request. Once the code scanning is complete, the analysis results (.sarif files) are downloaded and provided to Mobb to generate auto-remediation fixes.
5+
This action is used alongside the native CodeQL Code Scanning feature to monitor for the completion of a CodeQL scan within a Pull Request or on commits. Once the code scanning is complete, the analysis results (.sarif files) are downloaded and provided to Mobb to generate auto-remediation fixes.
6+
7+
## Supported Triggers
8+
9+
This action supports two types of CodeQL scans:
10+
11+
1. **Pull Request Scans**: Triggered when CodeQL runs on pull requests
12+
2. **Commit Scans**: Triggered when CodeQL runs on push events to branches
613

714
## Example usage
815

916
Create a file under the path `.github/workflow/mobb.yml`.
1017

11-
A sample content of the workflow file:
18+
### For Pull Requests and Commits (Recommended)
1219

1320
```yaml
1421
name: Mobb fix from CodeQL reports
1522
on:
1623
workflow_run:
17-
workflows: ["CodeQL"] # This workflow is triggered when the name specified here is triggered. In CodeQL Default Code Scanning Setup, this name is "CodeQL", if you are using CodeQL Advanced Setup, you may need to change this if you have a different workflow name.
24+
workflows: ["CodeQL"] # This workflow is triggered when the name specified here is triggered. In CodeQL Default Code Scanning Setup, this name is "CodeQL", if you are using CodeQL Advanced Setup, you may need to change this if you have a different workflow name.
1825
types:
1926
- completed
2027
jobs:
2128
handle_codeql_scan:
2229
runs-on: ubuntu-latest
23-
if: ${{ github.event.workflow_run.conclusion == 'success' && (contains(github.event.workflow_run.head_branch, 'refs/pull') || github.event.workflow_run.event == 'pull_request') }}
30+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
2431
permissions:
2532
pull-requests: write
2633
security-events: write
@@ -30,9 +37,37 @@ jobs:
3037
steps:
3138
- name: Checkout repository
3239
uses: actions/checkout@v4
33-
- name: Dump github.event
34-
run: cat $GITHUB_EVENT_PATH
40+
- uses: mobb-dev/codeql-mobb-fixer-action@v1.1
41+
with:
42+
mobb-api-token: ${{ secrets.MOBB_API_TOKEN }}
43+
github-token: ${{ secrets.GITHUB_TOKEN }}
44+
# Optional: specify organization and project
45+
# organization-id: "your-org-id"
46+
# mobb-project-name: "Your Project Name"
47+
```
3548

49+
### For Pull Requests Only (Legacy)
50+
51+
```yaml
52+
name: Mobb fix from CodeQL reports
53+
on:
54+
workflow_run:
55+
workflows: ["CodeQL"]
56+
types:
57+
- completed
58+
jobs:
59+
handle_codeql_scan:
60+
runs-on: ubuntu-latest
61+
if: ${{ github.event.workflow_run.conclusion == 'success' && (contains(github.event.workflow_run.head_branch, 'refs/pull') || github.event.workflow_run.event == 'pull_request') }}
62+
permissions:
63+
pull-requests: write
64+
security-events: write
65+
statuses: write
66+
contents: write
67+
issues: write
68+
steps:
69+
- name: Checkout repository
70+
uses: actions/checkout@v4
3671
- uses: mobb-dev/codeql-mobb-fixer-action@v1.1
3772
with:
3873
mobb-api-token: ${{ secrets.MOBB_API_TOKEN }}
@@ -49,15 +84,35 @@ jobs:
4984

5085
**Optional** The Mobb Project Name. If unspecified, it will go to "My First Project".
5186

87+
## `organization-id`
88+
89+
**Optional** The Mobb Organization ID. If specified, the analysis will be associated with the specified organization.
90+
5291
## `github-token`
5392

5493
**Required** The GitHub api token to use with the action. Usually available as `${{ secrets.GITHUB_TOKEN }}`.
5594

5695
## Results
57-
The fixes are presented in 2 formats:
58-
1. **Selected fixes in the pull request comments** - The fixes presented here only contain a subset of all available fixes that are only relevant to the context of the current pull request based on what has been changed in the diff.
96+
97+
The fixes are presented differently depending on the trigger type:
98+
99+
### For Pull Requests
100+
The fixes are presented in 2 formats:
101+
1. **Selected fixes in the pull request comments** - The fixes presented here only contain a subset of all available fixes that are only relevant to the context of the current pull request based on what has been changed in the diff.
59102
2. **Full fix report** - A full fix analysis report is available via the "Mobb Fix Report Link" in the status section. The fix report here contains all fixes relevant to the entire repository.
60103

104+
### For Commits
105+
For commit-triggered scans, the full fix report URL is available in the action output. Since there's no pull request context, the fixes include all vulnerabilities found in the scanned commit.
106+
107+
## Behavior Differences
108+
109+
| Feature | Pull Request Scans | Commit Scans |
110+
|---------|-------------------|--------------|
111+
| PR Comments | ✅ Yes | ❌ No |
112+
| Status Checks | ✅ Yes | ❌ No |
113+
| Fix Report URL | ✅ Yes (in status + output) | ✅ Yes (in output only) |
114+
| Scope | PR diff context | Full repository |
115+
61116
### Fixes shown in the PR comments
62117
![image](https://github.com/mobb-dev/codeql-mobb-fixer-action/assets/5158535/46161a99-4010-4ef1-90be-a06860f755a9)
63118

‎action.yml‎

Lines changed: 104 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: "codeql-mobb-fixer-action"
2-
description: "Mobb automatic vulnerability fixer action for GitHub CodeQL analysis"
2+
description: "Mobb automatic vulnerability fixer action for GitHub CodeQL analysis on pull requests and commits"
33
branding:
44
icon: aperture
55
color: blue
@@ -10,6 +10,9 @@ inputs:
1010
mobb-project-name:
1111
description: "Mobb Project Name"
1212
required: false
13+
organization-id:
14+
description: "Mobb Organization ID"
15+
required: false
1316
github-token:
1417
description: "GitHub token"
1518
required: true
@@ -46,30 +49,70 @@ runs:
4649
echo "triggering_event=$triggering_event"
4750
echo "head_branch=$head_branch"
4851
52+
# Initialize variables
53+
PR_NUMBER=""
54+
GITHUB_HEAD_REF=""
55+
IS_COMMIT_RUN=false
56+
4957
if [[ "$triggering_event" == "pull_request" ]]; then
5058
echo "Triggering event is a pull request, extracting PR Number from github.event.pull_request.number"
5159
PR_NUMBER=$(jq -r '.workflow_run.pull_requests[0].number' "$GITHUB_EVENT_PATH")
52-
53-
5460
echo PR_NUMBER: $PR_NUMBER
61+
62+
#Getting the head-ref for PR
63+
GITHUB_HEAD_REF=$(curl --header 'authorization: Bearer ${{ inputs.github-token }}' -s ${{github.event.workflow_run.repository.url}}/pulls/${PR_NUMBER} | jq -r '.head.ref')
64+
echo GITHUB_HEAD_REF: $GITHUB_HEAD_REF
65+
5566
elif [[ "$triggering_event" == "dynamic" && $head_branch == refs/pull/* ]]; then
5667
# Extract the PR number from the head_branch
5768
echo "Triggering event is a dynamic event, head_branch also contains */pull/* field, extracting PR Number from github.event.workflow_run.head_branch"
5869
PR_NUMBER=$(echo $head_branch | cut --delimiter='/' --fields=3 )
5970
echo PR_NUMBER: $PR_NUMBER
71+
72+
#Getting the head-ref for PR
73+
GITHUB_HEAD_REF=$(curl --header 'authorization: Bearer ${{ inputs.github-token }}' -s ${{github.event.workflow_run.repository.url}}/pulls/${PR_NUMBER} | jq -r '.head.ref')
74+
echo GITHUB_HEAD_REF: $GITHUB_HEAD_REF
75+
76+
elif [[ "$triggering_event" == "push" ]]; then
77+
echo "Triggering event is a push/commit, using commit SHA and branch"
78+
IS_COMMIT_RUN=true
79+
PR_NUMBER=""
80+
81+
# For push events, use the head_branch directly
82+
if [[ "$head_branch" == refs/heads/* ]]; then
83+
GITHUB_HEAD_REF=$(echo $head_branch | sed 's/refs\/heads\///')
84+
else
85+
GITHUB_HEAD_REF=$head_branch
86+
fi
87+
echo GITHUB_HEAD_REF: $GITHUB_HEAD_REF
88+
6089
else
61-
echo "Error: Unable to determine PR number from the triggering event. Please check if the triggering event is a PR."
62-
exit 1
90+
echo "Warning: Triggering event '$triggering_event' is not explicitly handled. Attempting to proceed as commit run."
91+
IS_COMMIT_RUN=true
92+
PR_NUMBER=""
93+
94+
# For other events, try to extract branch from head_branch
95+
if [[ "$head_branch" == refs/heads/* ]]; then
96+
GITHUB_HEAD_REF=$(echo $head_branch | sed 's/refs\/heads\///')
97+
else
98+
GITHUB_HEAD_REF=$head_branch
99+
fi
100+
echo GITHUB_HEAD_REF: $GITHUB_HEAD_REF
63101
fi
64102
65-
#Getting the pr-number
66-
echo PR_NUMBER: $PR_NUMBER
103+
#Setting outputs
67104
echo "pr-number=$PR_NUMBER" >> $GITHUB_OUTPUT
68-
69-
#Getting the head-ref
70-
GITHUB_HEAD_REF=$(curl --header 'authorization: Bearer ${{ inputs.github-token }}' -s ${{github.event.workflow_run.repository.url}}/pulls/${PR_NUMBER} | jq -r '.head.ref')
71-
echo GITHUB_HEAD_REF: $GITHUB_HEAD_REF
72105
echo "github-head-ref=$GITHUB_HEAD_REF" >> $GITHUB_OUTPUT
106+
echo "is-commit-run=$IS_COMMIT_RUN" >> $GITHUB_OUTPUT
107+
108+
# Log the run type for clarity
109+
if [[ "$IS_COMMIT_RUN" == "true" ]]; then
110+
echo "🔨 Running Mobb analysis for COMMIT on branch: $GITHUB_HEAD_REF"
111+
echo "📝 Commit SHA: $head_sha"
112+
else
113+
echo "🔀 Running Mobb analysis for PULL REQUEST #$PR_NUMBER"
114+
echo "📝 Branch: $GITHUB_HEAD_REF, SHA: $head_sha"
115+
fi
73116
74117
shell: bash -l {0}
75118

@@ -79,8 +122,9 @@ runs:
79122
ref: ${{ steps.env.outputs.github-head-ref }}
80123

81124

82-
# Displays status in the PR that this action is in 'pending' status
125+
# Displays status in the PR that this action is in 'pending' status (PR only)
83126
- uses: guibranco/github-status-action-v2@v1.1.13
127+
if: steps.env.outputs.is-commit-run != 'true'
84128
with:
85129
authToken: ${{ inputs.github-token }}
86130
context: "Mobb Fix Analysis"
@@ -98,16 +142,28 @@ runs:
98142
URL=$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/code-scanning/analyses
99143
echo "analyses list URL=$URL"
100144
response=$(curl -H "Authorization: Bearer ${{ inputs.github-token }}" $URL)
101-
echo length of code-scanning analyses list=$#{response}
145+
echo length of code-scanning analyses list=${#response}
102146
echo "analyses list: $response"
103-
# Extract all CodeQL Analyses IDs that has a matching ^refs/pull/ to the PR Number
104-
echo "Extract all CodeQL Analyses IDs that has a matching ^refs/pull/ to the PR Number"
105-
ids=$(echo "$response" | jq -r --arg pr "${{ steps.env.outputs.pr-number }}" '.[] | select(.ref | test("^refs/pull/" + $pr + "/")) | .id')
106-
147+
148+
# Different filtering logic based on whether this is a PR or commit run
149+
if [[ "${{ steps.env.outputs.is-commit-run }}" == "true" ]]; then
150+
echo "Filtering CodeQL analyses for commit run - matching SHA: ${{steps.env.outputs.head-sha}}"
151+
# For commit runs, filter by commit SHA
152+
ids=$(echo "$response" | jq -r --arg sha "${{steps.env.outputs.head-sha}}" '.[] | select((.commit_sha == $sha) and (.tool.name == "CodeQL")) | .id')
153+
else
154+
echo "Filtering CodeQL analyses for PR run - matching refs/pull/${{ steps.env.outputs.pr-number }}/"
155+
# For PR runs, filter by PR ref pattern
156+
ids=$(echo "$response" | jq -r --arg pr "${{ steps.env.outputs.pr-number }}" '.[] | select((.ref | test("^refs/pull/" + $pr + "/")) and (.tool.name == "CodeQL")) | .id')
157+
fi
158+
107159
echo "Matching analyses ids=$ids"
108160

109161
if [ -z "$ids" ]; then
110-
echo "Error: No matching IDs found for the given head SHA ${{steps.env.outputs.head-sha}}." >&2
162+
if [[ "${{ steps.env.outputs.is-commit-run }}" == "true" ]]; then
163+
echo "Error: No matching CodeQL analyses found for commit SHA ${{steps.env.outputs.head-sha}}." >&2
164+
else
165+
echo "Error: No matching CodeQL analyses found for PR ${{ steps.env.outputs.pr-number }}." >&2
166+
fi
111167
exit 1
112168
fi
113169

@@ -160,21 +216,38 @@ runs:
160216
GITHUB_SHA=${{steps.env.outputs.head-sha}}
161217
PR_NUMBER=${{ steps.env.outputs.pr-number }}
162218
GITHUB_HEAD_REF=${{ steps.env.outputs.github-head-ref }}
163-
219+
IS_COMMIT_RUN=${{ steps.env.outputs.is-commit-run }}
164220
165221
echo "github.event.workflow_run.head_branch = "${{github.event.workflow_run.head_branch}}
166222
echo REPO: $REPO
167223
echo GITHUB_HEAD_REF: $GITHUB_HEAD_REF
168224
echo GITHUB_SHA: $GITHUB_SHA
169225
echo PR_NUMBER: $PR_NUMBER
170-
MobbExecString="npx --yes mobbdev@latest review -r $REPO --ref $GITHUB_HEAD_REF --ch $GITHUB_SHA --api-key ${{ inputs.mobb-api-token }} -f sarif_output.json --pr $PR_NUMBER --github-token ${{ inputs.github-token }} --scanner $SCANNER"
226+
echo IS_COMMIT_RUN: $IS_COMMIT_RUN
227+
228+
# Build the Mobb command based on run type
229+
if [[ "$IS_COMMIT_RUN" != "true" && -n "$PR_NUMBER" ]]; then
230+
echo "Building PR review command for PR #$PR_NUMBER"
231+
# For PR runs, use 'review' command with --scanner and --pr parameters
232+
MobbExecString="npx --yes mobbdev@latest review -r $REPO --ref $GITHUB_HEAD_REF --ch $GITHUB_SHA --api-key ${{ inputs.mobb-api-token }} -f sarif_output.json --github-token ${{ inputs.github-token }} --scanner $SCANNER --pr $PR_NUMBER"
233+
else
234+
echo "Building commit analyze command - no PR parameters"
235+
# For commit runs, use 'analyze' command without --scanner and --pr parameters
236+
MobbExecString="npx --yes mobbdev@latest analyze -r $REPO --ref $GITHUB_HEAD_REF --api-key ${{ inputs.mobb-api-token }} -f sarif_output.json --ci"
237+
fi
171238
172239
# Check if mobb-project-name exists and append it
173240
if [ -n "${{ inputs.mobb-project-name }}" ]; then
174241
echo "mobb-project-name specified: ${{ inputs.mobb-project-name }}"
175242
MobbExecString+=" --mobb-project-name \"${{ inputs.mobb-project-name }}\""
176243
fi
177244
245+
# Check if organization-id exists and append it
246+
if [ -n "${{ inputs.organization-id }}" ]; then
247+
echo "organization-id specified: ${{ inputs.organization-id }}"
248+
MobbExecString+=" --organization-id \"${{ inputs.organization-id }}\""
249+
fi
250+
178251
# Output the final command string for debugging
179252
echo "Mobb Command: $MobbExecString"
180253
OUT=$(eval $MobbExecString)
@@ -185,17 +258,19 @@ runs:
185258
exit $RETVAL
186259
fi
187260
188-
# Process the output
261+
# Process the output - extract just the URL from any surrounding status messages
189262
OUT=$(echo $OUT | tr '\n' ' ')
190-
echo "fix-report-url=$OUT" >> $GITHUB_OUTPUT
191-
echo "Mobb URL: $OUT"
263+
MOBB_URL=$(echo "$OUT" | grep -oE 'https://[^ ]+' | head -1)
264+
echo "fix-report-url=$MOBB_URL" >> $GITHUB_OUTPUT
265+
echo "Mobb URL: $MOBB_URL"
192266
193267
shell: bash -l {0}
194268
env:
195269
PR_CONTEXT: ${{ toJson(github.event.workflow_run.pull_requests) }}
196270

197-
# Publish the Mobb fix report link in the PR
271+
# Publish the Mobb fix report link in the PR (PR only)
198272
- uses: guibranco/github-status-action-v2@v1.1.13
273+
if: steps.env.outputs.is-commit-run != 'true'
199274
with:
200275
authToken: ${{ inputs.github-token }}
201276
context: "Mobb Fix Report Link"
@@ -205,21 +280,21 @@ runs:
205280
description: "Click \"Details\" to access the full fix analysis report"
206281

207282

208-
# Displays status in the PR that this action is in 'complete' status
283+
# Displays status in the PR that this action is in 'complete' status (PR only)
209284
- uses: guibranco/github-status-action-v2@v1.1.13
210-
if: success()
285+
if: success() && steps.env.outputs.is-commit-run != 'true'
211286
with:
212287
authToken: ${{ inputs.github-token }}
213288
context: "Mobb Fix Analysis"
214289
state: "success"
215290
target_url: ${{ steps.env.outputs.action-run-path }}
216291
sha: ${{steps.env.outputs.head-sha}}
217-
description: "Mobb fix analysis completed. See comment in the PR for results"
292+
description: "Mobb fix analysis completed. See comment in the PR for results"
218293

219294

220-
# Displays status in the PR that this action is in 'failure' status
295+
# Displays status in the PR that this action is in 'failure' status (PR only)
221296
- uses: guibranco/github-status-action-v2@v1.1.13
222-
if: failure()
297+
if: failure() && steps.env.outputs.is-commit-run != 'true'
223298
with:
224299
authToken: ${{ inputs.github-token }}
225300
context: "Mobb Fix Analysis"

0 commit comments

Comments
 (0)