python-setup: Don't allow Poetry to make venv in project by RasmusWL · Pull Request #1419 · github/codeql-action (original) (raw)
Conversation
As highlighted in the code comments, Projects that specify in-project = true in their poetry.toml would get the venv created inside the repo directory, which would cause CodeQL to consider it as user-written code. We don't want this to happen.
Merge / deployment checklist
- Confirm this change is backwards compatible with existing workflows.
- Confirm the readme has been updated if necessary.
- Confirm the changelog has been updated if necessary.
I have not updated changelog or readme since I thought this was a small enough change, but let me know if you think that woudl be needed.
I mostly verified this works on my local machine, but did add a sample poetry.toml to the tests, so it can be verified from looking at the logs 🤷
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think we need to update the README for this change 😄
As for the CHANGELOG — do we expect the change to affect many users? If the venv was previously considered user-written code, and now isn't, it shouldn't affect any user's results (unless the venv itself had alerts), right?
As for the CHANGELOG — do we expect the change to affect many users?
Many? that's not my expectation, but it's a gut feeling and not based on hard data.
If the venv was previously considered user-written code, and now isn't, it shouldn't affect any user's results (unless the venv itself had alerts), right?
spot on. I think there's a fair chance there would have been spurious alerts found within the in-project venv though.
Altogether, I have time defending not making adding anything to the changelog, so let me just do that 👍
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for updating!
| ## [UNRELEASED] |
|---|
| - Add a step that tries to upload a SARIF file for the workflow run when that workflow run fails. This will help better surface failed code scanning workflow runs. [#1393](https://github.com/github/codeql-action/pull/1393) |
| - Python automatic dependency installation will no longer consider dependecy code installed in venv as user-written, for projects using Poetry that specify `virtualenvs.in-project = true` in their `poetry.toml`. [#1419](https://github.com/github/codeql-action/pull/1419). |
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| - Python automatic dependency installation will no longer consider dependecy code installed in venv as user-written, for projects using Poetry that specify `virtualenvs.in-project = true` in their `poetry.toml`. [#1419](https://github.com/github/codeql-action/pull/1419). |
|---|
| - Python automatic dependency installation will no longer consider dependency code installed in `venv` as user-written, for projects using Poetry that specify `virtualenvs.in-project = true` in their `poetry.toml`. [#1419](https://github.com/github/codeql-action/pull/1419). |
Quick typo suggestion
This was referenced
Dec 8, 2022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
[ Show hidden characters]({{ revealButtonHref }})
2 participants
