microsoft / GHAzDO-Resources

Resources, Scripts, etc. for GitHub Advanced Security on Azure DevOps
MIT License
31 stars 14 forks source link

CIGate.ps1 fails if target branch contains no alerts #27

Open rmartin-msft opened 6 months ago

rmartin-msft commented 6 months ago

When taking a new project where the main branch has no code or has limited code which results in no CodeQL alerts the CIGate.ps1 script throw an error on line 151 because prTargetAlertIds is null.

$jsonPRTarget = $alertsPRTarget.Content | ConvertFrom-Json
$jsonPRSource = $alertsPRSource.Content | ConvertFrom-Json

# Extract alert ids from the list of alerts on pr target/source branch.
$prTargetAlertIds = $jsonPRTarget.value | Select-Object -ExpandProperty alertId
$prSourceAlertIds = $jsonPRSource.value | Select-Object -ExpandProperty alertId

# Check for alert ids that are reported in the PR source branch but not the pr target branch
$newAlertIds = Compare-Object $prSourceAlertIds $prTargetAlertIds -PassThru | Where-Object { $_.SideIndicator -eq '<=' }

This can be fixed by adding a check to see if the prTargetAlertIds is null, and assigning newAlertIds to prSourceAlertIds to reflect that all the new alerts in the source PR branch are new.

davidcatriel commented 5 months ago

Thank you for the suggestion. Ended up implementing this on my end and it works well. Adding the suggested changes to https://github.com/microsoft/GHAzDO-Resources/pull/22.

Basically changes this (line 114) ...

# Check for alert ids that are reported in the PR source branch but not the pr target branch
$newAlertIds = Compare-Object $prSourceAlertIds $prTargetAlertIds -PassThru | Where-Object { $_.SideIndicator -eq '<=' }

to this ...

# Fix for cases where the garget branch does not contain any alerts. Source: https://github.com/microsoft/GHAzDO-Resources/issues/27 
if ($null -eq $prTargetAlertIds) {
    $newAlertIds = $prSourceAlertIds 
} else {
# Check for alert ids that are reported in the PR source branch but not the pr target branch
    $newAlertIds = Compare-Object $prSourceAlertIds $prTargetAlertIds -PassThru | Where-Object { $_.SideIndicator -eq '<=' }
}
davidcatriel commented 3 months ago

Update - now that Fix #42 has been merged, this fix is still needed but goes on line 200.