Hi,

Using the minimal example in our workflow:

-**/*                            # exclusion pattern: DENY ALL
myproject/**                     # inclusion pattern: allows alerts in the path 'myproject/'

Produces the following error:

Run advanced-security/filter-sarif@v1
Run unset LD_PRELOAD
Given patterns:
files: **/*    # exclusion    rules:  DENY ALL (negative)
files: src/**   # inclusion    rules: ** (positive)
Traceback (most recent call last):
  File "/home/runner/work/_actions/advanced-security/filter-sarif/v1/filter_sarif.py", line 147, in <module>
    main()
  File "/home/runner/work/_actions/advanced-security/filter-sarif/v1/filter_sarif.py", line 144, in main
    filter_sarif(args)
  File "/home/runner/work/_actions/advanced-security/filter-sarif/v1/filter_sarif.py", line 99, in filter_sarif
    if uri is None or match_path_and_rule(uri, ruleId, args.patterns):
  File "/home/runner/work/_actions/advanced-security/filter-sarif/v1/filter_sarif.py", line 16, in match_path_and_rule
    if match(rp, rule) and match(fp, path):
  File "/home/runner/work/_actions/advanced-security/filter-sarif/v1/globber.py", line 79, in match
    raise ValueError('** in {} not alone between path separators'.format(pattern))
ValueError: ** in src/**   # inclusion not alone between path separators
Error: Process completed with exit code 1.

Should we fix this example and what is a valid way of including a single directory?

I am trying this for now:

-**/*
myproject/**/*

Thanks!

The same way the CodeQL Action supports a config-file, it would be great for this Action to support the same. This way, if there are many patterns, the workflow would be cleaner.

Would be great if this task would be available for Azure DevOps pipelines, too.

this is more a question for the advanced-security organization owners.
(i've asked the same question here.)

it looks like your organization is managed by GitHub.
is this the case?

i'm missing a "verified" label, as is the case on the actions oganization.

this is important for my company, as we can only trust actions that are managed by GitHub themselves.

thanks for your help! 🙂

Please can we tag the HEAD of the develop branch with 1.0-filter-message, or something similar?

I'd like to point users at this feature, before it's merged to main, but don't want to just use develop since that might change to include a different new feature (in theory!).

@zbazztian

When I attempt to use filter-sarif in my workflow with the v1 tag it fails with an error: TypeError: 'type' object is not subscriptable.

I did some investigation and this is due to the globber.py -> _match_components function due to the list[str] usage. I see in the develop branch this has been fixed, here, with the addition of the typing import and code change as well.

Are there any plans to create a new tag that works? For now I am just referencing the main branch's latest commit SHA.