Skip to main content

code scanning์— CodeQL ๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •ํ–ˆ๊ธฐ ๋•Œ๋ฌธ์— ์—…๋กœ๋“œ๊ฐ€ ๊ฑฐ๋ถ€๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

code scanning์— ๋Œ€ํ•œ ๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •๋œ ๊ฒฝ์šฐ CodeQL ์ž‘์—… ๋˜๋Š” CodeQL CLI์— ์˜ํ•ด ์ƒ์„ฑ๋œ SARIF ๊ฒฐ๊ณผ๋ฅผ ์—…๋กœ๋“œํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค. ๊ตฌ์„ฑ์„ ํ™•์ธํ•˜๊ณ  ๊ธฐ๋ณธ ์„ค์ •์„ ์œ ์ง€ํ• ์ง€ ๋˜๋Š” SARIF ์—…๋กœ๋“œ ์ฐจ๋‹จ์„ ํ•ด์ œํ• ์ง€ ๊ฒฐ์ •ํ•ฉ๋‹ˆ๋‹ค.

์ด ์˜ค๋ฅ˜ ์ •๋ณด

Upload with CodeQL results rejected due to "default setup"

์ด ์˜ค๋ฅ˜๋Š” ํ”„๋กœ์„ธ์Šค์—์„œ CodeQL ๋ถ„์„ ๊ฒฐ๊ณผ๋ฅผ ํฌํ•จํ•˜๋Š” SARIF ํŒŒ์ผ์„ CodeQL ๊ธฐ๋ณธ ์„ค์ •์ด ์„ค์ •๋œ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ์—…๋กœ๋“œํ•˜๋ ค๊ณ  ์‹œ๋„ํ•˜๋Š” ๊ฒฝ์šฐ ๋ณด๊ณ ๋ฉ๋‹ˆ๋‹ค. ์—ฌ๊ธฐ์—๋Š” REST API ๋ฐ CodeQL CLI์„(๋ฅผ) ์‚ฌ์šฉํ•˜๋Š” ์—…๋กœ๋“œ๊ฐ€ ํฌํ•จ๋ฉ๋‹ˆ๋‹ค. ๋‹ค๋ฅธ ์‹œ์Šคํ…œ์—์„œ ์ƒ์„ฑ๋œ ์œ ์‚ฌํ•œ code scanning ๊ฒฝ๊ณ ๋ฅผ ํ™•์ธํ•˜์—ฌ ์‚ฌ์šฉ์ž๊ฐ€ ํ˜ผ๋™ํ•  ๊ฐ€๋Šฅ์„ฑ์„ ์ค„์ด๊ธฐ ์œ„ํ•ด CodeQL ๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •ํ•˜๋ฉด SARIF ์—…๋กœ๋“œ๊ฐ€ ์ฐจ๋‹จ๋ฉ๋‹ˆ๋‹ค.

CodeQL์„(๋ฅผ) ์‚ฌ์šฉํ•˜์—ฌ ๋งŒ๋“  ๊ฒฐ๊ณผ๋ฅผ ํฌํ•จํ•˜๋Š” SARIF ํŒŒ์ผ์— ๋Œ€ํ•ด์„œ๋งŒ ์ด ์˜ค๋ฅ˜๊ฐ€ ํ‘œ์‹œ๋ฉ๋‹ˆ๋‹ค.

์˜ค๋ฅ˜์˜ ์›์ธ ํ™•์ธ

  1. GitHub์—์„œ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์˜ ๊ธฐ๋ณธ ํŽ˜์ด์ง€๋กœ ์ด๋™ํ•ฉ๋‹ˆ๋‹ค.

  2. ๋ฆฌํฌ์ง€ํ† ๋ฆฌ ์ด๋ฆ„ ์•„๋ž˜์—์„œ ์„ค์ •์„ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค. "์„ค์ •" ํƒญ์ด ํ‘œ์‹œ๋˜์ง€ ์•Š์œผ๋ฉด ๋“œ๋กญ๋‹ค์šด ๋ฉ”๋‰ด๋ฅผ ์„ ํƒํ•œ ๋‹ค์Œ ์„ค์ •์„ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.

    ํƒญ์„ ๋ณด์—ฌ ์ฃผ๋Š” ๋ฆฌํฌ์ง€ํ† ๋ฆฌ ํ—ค๋”์˜ ์Šคํฌ๋ฆฐ์ƒท. "์„ค์ •" ํƒญ์ด ์ง„ํ•œ ์ฃผํ™ฉ์ƒ‰ ์œค๊ณฝ์„ ์œผ๋กœ ๊ฐ•์กฐ ํ‘œ์‹œ๋ฉ๋‹ˆ๋‹ค.

  3. ์‚ฌ์ด๋“œ๋ฐ”์˜ "Security" ์„น์…˜์—์„œ Advanced Security ๋ฅผ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.

  4. ํŽ˜์ด์ง€์˜ โ€œCode Securityโ€ ์„น์…˜์—์„œ โ€œCodeQL analysisโ€ ์˜†์— ๋ฅผ ํด๋ฆญํ•˜์„ธ์š”.

  5. ๊ณ ๊ธ‰ ์˜ต์…˜์œผ๋กœ ์ „ํ™˜์ด ์žˆ๋Š” ๊ฒฝ์šฐ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ๋Œ€ํ•œ ๊ธฐ๋ณธ ์„ค์ •์ด ํ™œ์„ฑํ™”๋ฉ๋‹ˆ๋‹ค.

๋ฌธ์ œ ํ•ด๊ฒฐ

์ด ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜๋ ค๋ฉด ์ด ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์˜ CodeQL ๋ถ„์„์—์„œ code scanning ๊ฒฝ๊ณ ๋ฅผ ๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜์—ฌ ์ƒ์„ฑํ• ์ง€ ๋˜๋Š” SARIF ํŒŒ์ผ์—์„œ ์—…๋กœ๋“œํ•ด์•ผ ํ•˜๋Š”์ง€ ๊ฒฐ์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜์—ฌ ๊ฒฝ๊ณ  ์ƒ์„ฑ ๊ณ„์†

  1. ๋ฆฌํฌ์ง€ํ† ๋ฆฌ ์„ค์ •์„ ๊ทธ๋Œ€๋กœ ๋‘๊ณ  ๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค.
  2. SARIF ํŒŒ์ผ์„ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ์—…๋กœ๋“œํ•˜๋ ค๋Š” ํ”„๋กœ์„ธ์Šค๋ฅผ ์‚ฌ์šฉํ•˜์ง€ ์•Š๋„๋ก ์„ค์ •ํ•ฉ๋‹ˆ๋‹ค.

๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜์ง€ ์•Š๋„๋ก ์„ค์ •ํ•˜์—ฌ SARIF ์—…๋กœ๋“œ ์ฐจ๋‹จ ํ•ด์ œ

  1. ํŽ˜์ด์ง€์˜ "Code scanning" ์„น์…˜์— ์žˆ๋Š” "CodeQL ๋ถ„์„" ์˜†์˜ ๋ฉ”๋‰ด์—์„œ CodeQL ๋น„ํ™œ์„ฑํ™”๋ฅผ ์„ ํƒํ•ฉ๋‹ˆ๋‹ค.
  2. ํ”„๋กœ์„ธ์Šค๋ฅผ ๋‹ค์‹œ ์‹คํ–‰ํ•˜์—ฌ SARIF ํŒŒ์ผ์„ ์—…๋กœ๋“œํ•ฉ๋‹ˆ๋‹ค. ์ด์ œ SARIF ํŒŒ์ผ์ด code scanning์— ๋Œ€ํ•œ ์š”๊ตฌ ์‚ฌํ•ญ์„ ์ถฉ์กฑํ•˜๋Š” ๊ฒฝ์šฐ ์„ฑ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์œ ํšจ์„ฑ ๊ฒ€์‚ฌ ๋ฐ code scanning์—์„œ ์ง€์›ํ•˜๋Š” ํ˜•์‹์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ ์ฝ”๋“œ ๊ฒ€์‚ฌ์— ๋Œ€ํ•œ SARIF ์ง€์›์„(๋ฅผ) ์ฐธ์กฐํ•˜์„ธ์š”.