| 1 | #!/usr/bin/env bash |
| 2 | # List GitHub Code Scanning alerts (CodeQL with security-extended) for the repo. |
| 3 | # |
| 4 | # Usage: |
| 5 | # codeql-list.sh # all OPEN alerts (default) |
| 6 | # codeql-list.sh --state=open|fixed|dismissed |
| 7 | # codeql-list.sh --severity=critical|high|medium|low|warning|note|error |
| 8 | # codeql-list.sh --tool=CodeQL # filter by tool name |
| 9 | # codeql-list.sh --raw # emit raw JSON instead of summary |
| 10 | # |
| 11 | # Authentication uses the `gh` CLI's stored credentials. |
| 12 | # This is a READ-ONLY script. |
| 13 | |
| 14 | set -euo pipefail |
| 15 | |
| 16 | # shellcheck source=./_lib.sh |
| 17 | # shellcheck disable=SC1091 |
| 18 | source "$(dirname "$0")/_lib.sh" |
| 19 | |
| 20 | state="open" |
| 21 | severity="" |
| 22 | tool="" |
| 23 | raw=0 |
| 24 | |
| 25 | while [[ $# -gt 0 ]]; do |
| 26 | case "$1" in |
| 27 | --state=*) state="${1#*=}"; shift ;; |
| 28 | --severity=*) severity="${1#*=}"; shift ;; |
| 29 | --tool=*) tool="${1#*=}"; shift ;; |
| 30 | --raw) raw=1; shift ;; |
| 31 | -h|--help) |
| 32 | sed -n '2,12p' "$0"; exit 0 ;; |
| 33 | *) echo "Unknown arg: $1" >&2; exit 2 ;; |
| 34 | esac |
| 35 | done |
| 36 | |
| 37 | slug="$(gh_require_slug)" |
| 38 | |
| 39 | # Build the API path. |
| 40 | path="/repos/${slug}/code-scanning/alerts?state=${state}&per_page=100" |
| 41 | [[ -n "${severity}" ]] && path="${path}&severity=${severity}" |
| 42 | [[ -n "${tool}" ]] && path="${path}&tool_name=${tool}" |
| 43 | |
| 44 | # `gh api --paginate` writes the per-page JSON arrays back-to-back |
| 45 | # (e.g. `[a,b,c][d,e]`), which is NOT a single valid JSON array. Pipe |
| 46 | # through `jq -s 'add'` to slurp the multiple top-level values into one |
| 47 | # array. Without this, downstream `jq '.[]'` only sees the first page. |
| 48 | echo -e "${GH_GRAY}> gh api --paginate ${path}${GH_NC}" >&2 |
| 49 | data="$(gh_api api --paginate "${path}" | jq -s 'add // []')" |
| 50 | |
| 51 | if (( raw )); then |
| 52 | printf '%s\n' "${data}" |
| 53 | exit 0 |
| 54 | fi |
| 55 | |
| 56 | # Compact summary: count by rule. |
| 57 | printf '%s\n' "${data}" \ |
| 58 | | jq -r '.[] | "\(.rule.id)|\(.rule.severity)|\(.most_recent_instance.location.path):\(.most_recent_instance.location.start_line)"' \ |
| 59 | | awk -F'|' '{c[$1"|"$2]++} END{for (k in c) print c[k], k}' \ |
| 60 | | sort -rn \ |
| 61 | | head -40 \ |
| 62 | | column -t -s'|' |