feat: Update CodeQL binary detection logic in workflow

advanced-security · Dec 5, 2024 · d1c7f2f · d1c7f2f
1 parent 556b438
commit d1c7f2f
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/.github/workflows/codeql-ql.yml b/.github/workflows/codeql-ql.yml
@@ -62,14 +62,20 @@ jobs:
           CODEQL_REPOSITORY_PATH="${CODEQL_REPOSITORY_PATH:-$HOME/.codeql/codeql-ql}"
           CODEQL_SUITE="${CODEQL_SUITE:-$CODEQL_REPOSITORY_PATH/ql/ql/src/codeql-suites/ql-code-scanning.qls}"
 
-          if which codeql >/dev/null; then
+          # Glob for Actions toolcache
+          CODEQL_GLOB='$RUNNER_TOOL_CACHE/CodeQL/*/x64/codeql/codeql'
+
+          if [ -f "$CODEQL_GLOB" ]; then
+            CODEQL_BINARY=$(echo $CODEQL_GLOB)
+          elif which codeql >/dev/null; then
             CODEQL_BINARY="codeql"
           elif gh codeql >/dev/null; then
             CODEQL_BINARY="gh codeql"
           else
             gh extension install github/gh-codeql
             CODEQL_BINARY="gh codeql"
           fi
+          echo "[+] Using codeql binary: $CODEQL_BINARY"
 
           $CODEQL_BINARY database create \
               --language ql --overwrite \