Add PSScriptAnalyzer workflow for PowerShell scripts - #282
Add PSScriptAnalyzer workflow for PowerShell scripts#282drdave-flexnetos wants to merge 1 commit into
Conversation
This workflow runs PSScriptAnalyzer on the repository to enforce coding standards and security rules.
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Upload the SARIF file generated in the previous step | ||
| - name: Upload SARIF results file | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: results.sarif |
There was a problem hiding this comment.
This job runs on pull_request and always executes github/codeql-action/upload-sarif, which requires security-events: write. GitHub does not grant that permission to the GITHUB_TOKEN for pull requests from forks, so external contributors’ runs will fail with “Resource not accessible by integration” when this step executes. Gate the upload to non-fork events or use a different trigger to keep forked PRs passing.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR adds a GitHub Actions workflow to run PSScriptAnalyzer on PowerShell scripts in the repository. The workflow enforces coding standards and security rules by running on pushes to main, pull requests, and weekly via scheduled cron job.
Key Changes:
- Adds PSScriptAnalyzer workflow with security scanning and SARIF upload integration
- Configures specific security rules to check for global aliases and insecure string conversion
- Sets up weekly scheduled scans and PR-based checks
| with: | ||
| # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options. | ||
| # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules. | ||
| path: .\ |
There was a problem hiding this comment.
The path separator .\ is Windows-specific but the workflow runs on ubuntu-latest. On Linux, this should be ./ or just . to correctly reference the current directory. This will cause the PSScriptAnalyzer to fail to find PowerShell scripts.
| path: .\ | |
| path: ./ |
| path: .\ | ||
| recurse: true | ||
| # Include your own basic security rules. Removing this option will run all the rules | ||
| includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"' |
There was a problem hiding this comment.
The includeRule parameter value has unnecessary double quotes around the array. According to PSScriptAnalyzer action documentation, this should be a comma-separated string without outer quotes wrapping the entire value. The current format '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"' will likely be interpreted as a single rule name instead of two separate rules. Change to: PSAvoidGlobalAliases, PSAvoidUsingConvertToSecureStringWithPlainText
| includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"' | |
| includeRule: PSAvoidGlobalAliases, PSAvoidUsingConvertToSecureStringWithPlainText |
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | ||
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||
| name: PSScriptAnalyzer | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
[nitpick] Consider adding fail-fast: false strategy if you plan to expand this matrix in the future, or consider testing on Windows runners as well since the repository contains many PowerShell scripts that may use Windows-specific features (based on the prevalence of .\ path separators in the codebase).
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} |
This workflow runs PSScriptAnalyzer on the repository to enforce coding standards and security rules.