fix: preserve CodeQL issues when scans are unavailable

Author: msukkari

.github/scripts/classify-vulnerability-issues.jq

@@ -12,6 +12,8 @@ def finding_id($prefix):
     | .findingId as $findingId
     | if .findingId == "" then
         . + { action: "ignore" }
+      elif ($skipCodeql and (.findingId | startswith("codeql:"))) then
+        . + { action: "ignore" }
       elif ($currentIds | index($findingId)) != null then
         . + { action: "keep" }
       else

.github/scripts/test-vulnerability-triage.sh

@@ -201,13 +201,17 @@ OPEN_ISSUES='[
   }
 ]'
 
-CLASSIFIED="$(jq -c --arg prefix "$PREFIX" --slurpfile findings <(printf '%s\n' "$FINDINGS") -f "$CLASSIFY_FILTER" <<<"$OPEN_ISSUES")"
+CLASSIFIED="$(jq -c --arg prefix "$PREFIX" --argjson skipCodeql false --slurpfile findings <(printf '%s\n' "$FINDINGS") -f "$CLASSIFY_FILTER" <<<"$OPEN_ISSUES")"
 assert_json "keeps every exact current finding" "$(jq -c '[.[] | select(.action == "keep") | .id]' <<<"$CLASSIFIED")" '["keep-cve","keep-codeql"]'
 assert_json "closes only resolved managed findings" "$(jq -c '[.[] | select(.action == "close") | .id]' <<<"$CLASSIFIED")" '["close-cve","close-prefix-collision"]'
 assert_json "ignores unrelated titles and repositories" "$(jq -c '[.[] | select(.action == "ignore") | .id]' <<<"$CLASSIFIED")" '["ignore-other-repo","ignore-unmanaged"]'
 
 EMPTY_FINDINGS='{"cves":[]}'
-CLASSIFIED_EMPTY="$(jq -c --arg prefix "$PREFIX" --slurpfile findings <(printf '%s\n' "$EMPTY_FINDINGS") -f "$CLASSIFY_FILTER" <<<"$OPEN_ISSUES")"
+CLASSIFIED_EMPTY="$(jq -c --arg prefix "$PREFIX" --argjson skipCodeql false --slurpfile findings <(printf '%s\n' "$EMPTY_FINDINGS") -f "$CLASSIFY_FILTER" <<<"$OPEN_ISSUES")"
 assert_json "closes all managed issues when a complete scan is clean" "$(jq -c '[.[] | select(.action == "close") | .id]' <<<"$CLASSIFIED_EMPTY")" '["keep-cve","keep-codeql","close-cve","close-prefix-collision"]'
 
+CLASSIFIED_WITH_CODEQL_SKIPPED="$(jq -c --arg prefix "$PREFIX" --argjson skipCodeql true --slurpfile findings <(printf '%s\n' "$EMPTY_FINDINGS") -f "$CLASSIFY_FILTER" <<<"$OPEN_ISSUES")"
+assert_json "preserves CodeQL issues when CodeQL is unavailable" "$(jq -c '[.[] | select(.action == "ignore") | .id]' <<<"$CLASSIFIED_WITH_CODEQL_SKIPPED")" '["keep-codeql","ignore-other-repo","ignore-unmanaged"]'
+assert_json "still closes resolved non-CodeQL issues when CodeQL is unavailable" "$(jq -c '[.[] | select(.action == "close") | .id]' <<<"$CLASSIFIED_WITH_CODEQL_SKIPPED")" '["keep-cve","close-cve","close-prefix-collision"]'
+
 echo "All vulnerability triage reconciliation tests passed."

.github/workflows/vulnerability-triage.yml

@@ -937,6 +937,7 @@ jobs:
           REPOSITORY: ${{ github.repository }}
           TEAM_UUID: ${{ steps.match.outputs.team_uuid }}
           DONE_STATE_ID: ${{ steps.match.outputs.done_state_id }}
+          SKIP_CODEQL: ${{ inputs.skip_codeql }}
         run: |
           set -euo pipefail
           # The job only reaches this step after every configured scanner
@@ -985,6 +986,7 @@ jobs:
 
           jq \
             --arg prefix "$PREFIX" \
+            --argjson skipCodeql "$SKIP_CODEQL" \
             --slurpfile findings findings.json \
             -f .vulnerability-triage-workflow/.github/scripts/classify-vulnerability-issues.jq \
             /tmp/open-issues.json > /tmp/classified-issues.json