| 1 | #!/usr/bin/env bash |
| 2 | # Dismiss one GitHub Code Scanning alert. |
| 3 | # |
| 4 | # Usage: |
| 5 | # codeql-dismiss.sh <alert_number> <reason> "<comment>" |
| 6 | # |
| 7 | # Reasons (per GitHub API): |
| 8 | # false positive -- alert is incorrect |
| 9 | # won't fix -- alert is correct but won't be fixed |
| 10 | # used in tests -- alert appears only in test code |
| 11 | # |
| 12 | # This script is WRITE-side: it changes the state of an alert. Use codeql-list.sh |
| 13 | # (read-only) to find alert numbers first. |
| 14 | |
| 15 | set -euo pipefail |
| 16 | |
| 17 | # shellcheck source=./_lib.sh |
| 18 | # shellcheck disable=SC1091 |
| 19 | source "$(dirname "$0")/_lib.sh" |
| 20 | |
| 21 | NUMBER="${1:?usage: $0 <alert_number> <reason> '<comment>'}" |
| 22 | REASON="${2:?usage}" |
| 23 | COMMENT="${3:?usage}" |
| 24 | |
| 25 | if [[ ! "${NUMBER}" =~ ^[1-9][0-9]*$ ]]; then |
| 26 | echo -e "${GH_RED}[ERROR]${GH_NC} alert_number must be a positive integer, got: '${NUMBER}'" >&2 |
| 27 | exit 1 |
| 28 | fi |
| 29 | |
| 30 | case "${REASON}" in |
| 31 | "false positive"|"won't fix"|"used in tests") ;; |
| 32 | *) |
| 33 | echo -e "${GH_RED}[ERROR]${GH_NC} Reason must be one of: 'false positive', \"won't fix\", 'used in tests'." >&2 |
| 34 | exit 2 |
| 35 | ;; |
| 36 | esac |
| 37 | |
| 38 | slug="$(gh_require_slug)" |
| 39 | echo -e "${GH_GRAY}> Dismissing alert #${NUMBER} on ${slug}: ${REASON}${GH_NC}" >&2 |
| 40 | echo -e "${GH_GRAY} comment: ${COMMENT}${GH_NC}" >&2 |
| 41 | |
| 42 | gh_api api --method PATCH "/repos/${slug}/code-scanning/alerts/${NUMBER}" \ |
| 43 | -f state=dismissed \ |
| 44 | -f dismissed_reason="${REASON}" \ |
| 45 | -f dismissed_comment="${COMMENT}" \ |
| 46 | --jq '{number, state, dismissed_reason, dismissed_comment, html_url}' |