kibana/scripts
Elena Shostak 9dd4205639
[CodeQL] Local run script (#194272)
## Summary

This PR introduces a script that allows developers to run CodeQL
analysis locally. It uses a Docker container with prebuilt CodeQL
queries to facilitate easy setup and execution.
The script has the following key steps:
- Creating a CodeQL database from the source code. The database is
essentially a representation of the codebase that CodeQL uses to analyze
for potential issues.
- Running the analysis on the created database,
`javascript-security-and-quality` suit is used.

### Usage
```
bash scripts/codeql/quick_check.sh -s path/to/your-source-dir
```
For example
```
bash scripts/codeql/quick_check.sh -s ./x-pack/plugins/security_solution/public/common/components/ml/conditional_links
```

The `-s` option allows you to specify the path to the source code
directory that you wish to analyze.

### Why custom Docker file?
Checked the ability to use MSFT image for local run
https://github.com/microsoft/codeql-container. Turned out it has several
problems:
1. The published one has an error with [execute
permissions](https://github.com/microsoft/codeql-container/issues/53).
2. Container has outdated nodejs version, so it didn't parse our syntax
(like `??`) and failed.
3. The technique used in the repository to download the CodeQL binaries
and precompile the queries is outdated in the sense that GitHub now
offers pre-compiled queries you can just download. Follow this
[comment](https://github.com/microsoft/codeql-container/issues/53#issuecomment-1875879512).

Taking this into consideration I have created a lightweight docker image
without extraneous dependencies for go/.net/java.

## Context and interdependencies issues
There are issues sometimes when analyze run returns no results,
particularly when analyzing a single folder.
It might be due to the missing context for the data flow graph CodeQL
generates or context for interdependencies. This is actually a trade off
of running it locally for a subset of source directories. We need to
explicitly state that in the documentation and advise to expand the
scope of source code directories involved for local scan.

Documentation for triaging issues will be updated separately.

__Closes: https://github.com/elastic/kibana/issues/195740__
2024-10-28 13:40:27 +01:00
..
codeql [CodeQL] Local run script (#194272) 2024-10-28 13:40:27 +01:00
archive_migration_functions.sh [QA] Fixup flaky test (#156373) 2023-05-08 11:32:53 +01:00
backport.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
build.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
build_api_docs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
build_kibana_platform_plugins.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
build_plugin_list_docs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
build_product_doc_artifacts.js [KB] create @kbn/product-doc-artifact-builder package (#193847) 2024-10-07 07:21:09 -05:00
capture_oas_snapshot.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
check_file_casing.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
check_ftr_code_owners.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
check_ftr_configs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
check_jest_configs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
check_licenses.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
check_mappings_update.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
check_prod_native_modules.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
chromium_version.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
classify_source.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
create_observability_rules.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
delete_kibana_indices.sh Script to delete .kibana indices (#157491) 2023-05-16 14:28:01 +02:00
dev_docs.sh [Docs] Added OAS dev tutorial (#187573) 2024-07-05 08:47:14 +00:00
docs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
download_pr_list.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
enabled_ftr_configs.js Updated js-yaml to v4 (#190678) 2024-09-19 12:25:03 +02:00
es.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
es_archiver.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
eslint.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
eslint_with_types.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
extract_performance_testing_dataset.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
find_babel_runtime_helpers_in_use.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
find_node_libs_browser_polyfills_in_use.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
functional_test_runner.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
functional_tests.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
functional_tests_server.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
generate.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
generate_console_definitions.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
generate_openapi.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
generate_plugin.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
generate_team_assignments.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
get_owners_for_file.js [Test Owners] Add script to get owners for files (#193277) 2024-09-20 14:16:08 +01:00
i18n_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
i18n_extract.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
i18n_integrate.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
ingest_coverage.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
jest.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
jest_integration.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kbn.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kbn_archiver.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kibana.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kibana_encryption_keys.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kibana_keystore.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kibana_plugin.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kibana_setup.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
kibana_verification_code.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
licenses_csv_report.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
lint_packages.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
lint_ts_projects.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
makelogs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
manifest.js Add ESLINT constraints to detect inter-group dependencies (#194810) 2024-10-22 06:34:19 -05:00
notice.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
plugin_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
plugin_helpers.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
precommit_hook.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
prettier_topology_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
quick_checks.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
read_jest_help.mjs Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
README.md [ftr] automatically determine config run order (#130983) 2022-05-04 17:05:58 -05:00
register_git_hook.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
report_failed_tests.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
report_performance_metrics.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
rewrite_buildkite_definitions.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
run_performance.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
run_scalability.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
saved_objs_info.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
ship_ci_stats.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
snapshot_plugin_types.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
storybook.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
stylelint.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
synthtrace.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
telemetry_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
telemetry_extract.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
test_hardening.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
type_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
update_prs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
update_vscode_config.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
validate_next_docs.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
whereis_pkg.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
yarn_deduplicate.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00

Kibana Dev Scripts

This directory contains scripts useful for interacting with Kibana tools in development. Use the node executable and --help flag to learn about how they work:

node scripts/{{script name}} --help

For Developers

This directory is excluded from the build and tools within it should help users discover their capabilities. Each script in this directory must:

  • require src/setup_node_env to bootstrap NodeJS environment
  • call out to source code in the src or packages directories
  • react to the --help flag
  • run everywhere OR check and fail fast when a required OS or toolchain is not available

Functional Test Scripts

node scripts/functional_tests [--config test/functional/config.base.js --config test/api_integration/config.js]

Runs all the functional tests: selenium tests and api integration tests. List configs with multiple --config arguments. Uses the @kbn/test library to run Elasticsearch and Kibana servers and tests against those servers, for multiple server+test setups. In particular, calls out to runTests(). Can be run on a single config.

node scripts/functional_tests_server [--config test/functional/config.base.js]

Starts just the Elasticsearch and Kibana servers given a single config, i.e. via --config test/functional/config.base.js or --config test/api_integration/config. Allows the user to start just the servers with this script, and keep them running while running tests against these servers. The idea is that the same config file configures both Elasticsearch and Kibana servers. Uses the startServers() method from @kbn/test library.

Example. Start servers and run tests, separately, but using the same config:

# Just the servers
node scripts/functional_tests_server --config path/to/config

In another terminal:

# Just the tests--against the running servers
node scripts/functional_test_runner --config path/to/config

For details on how the internal methods work, read this readme.

ES archiver

Loading data

If you wish to load up specific es archived data for your test, you can do so via:

node scripts/es_archiver.js load <archive> [--es-url=http://username:password@localhost:9200] [--kibana-url=http://username:password@localhost:5601/{basepath?}]

That will load the specified archive located in the archive directory specified by the default functional config file, located in test/functional/config.base.js. To load archives from other function config files you can pass --config path/to/config.js.

Note: The --es-url and --kibana-url options may or may not be neccessary depending on your current Kibana configuration settings, and their values may also change based on those settings (for example if you are not running with security you will not need the username:password portion).

Saving data

You can save existing data into an archive by using the save command:

node scripts/es_archiver.js save <archive name for kibana data> [space separated list of index patterns to include]

You may want to store the .kibana index separate from data. Since adding a lot of data will bloat our repo size, we have many tests that reuse the same data indices but use their own .kibana index.