Exclude languages (advanced-security#2)

* add support for C

* excluded languages

* fix issue with json parsing

* add some print statements for TS

* troubleshooting

* ts

* try split

* try split

* remove print

* trying quotes

* print statements for ts

* converting exclude to a set

* fix with strip and add log

* change excluded languages to exclude

* updated documentation

Author: leftrightleft

README.md

@@ -8,6 +8,8 @@ The default Actions workflow for CodeQL auto-populates the job matrix with your
 
 This action reads the repository languages API and adds all supported languages to the job matrix.  No additional configuration is required.
 
+Learn more about the supported CodeQL languages [here](https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed)
+
 ## How to use this action
 
 Call this action before defining the CodeQL analyze job strategy, then set the matrix to the output from the action: `${{ fromJSON(needs.create-matrix.outputs.matrix) }}`
@@ -51,9 +53,6 @@ jobs:
       fail-fast: false
       matrix: 
         language: ${{ fromJSON(needs.create-matrix.outputs.matrix) }}
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'kotlin' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
     - name: Checkout repository
@@ -74,6 +73,27 @@ jobs:
       with:
         category: "/language:${{matrix.language}}"
 ```      
+
+### Excluding CodeQL Languages
+It's possible you may choose to exclude specific languages from your CodeQL scans. In that canse, use the `exclude` input.
+
+Example:
+```
+  create-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.languages }}
+    steps:
+      - name: Get languages from repo
+        id: set-matrix
+        uses: advanced-security/set-codeql-language-matrix@v1
+        with:
+          access-token: ${{ secrets.GITHUB_TOKEN }}
+          endpoint: ${{ github.event.repository.languages_url }}
+          exclude: 'java, python'
+
+```
+
 ## License 
 
 This project is licensed under the terms of the MIT open source license. Please refer to [MIT](./LICENSE.md) for the full terms.

action.yml

@@ -8,6 +8,9 @@ inputs:
   endpoint:
     description: 'languages API endpoint'
     required: true
+  exclude:
+    description: 'Use a comma separated list here to exclude specific languges from your CodeQL scan.  Example: "python, java"'
+    required: false
 outputs:
   languages:
     description: 'List of languages that will set the job matrix'
@@ -17,5 +20,5 @@ runs:
   args:
    - ${{ inputs.access-token }}
    - ${{ inputs.endpoint }}
-   - ${{ inputs.codeql-languages }}
+   - ${{ inputs.exclude }}
 

entrypoint.sh

@@ -1,4 +1,4 @@
 #!/bin/sh -l
 
 # kick off the command
-python /main.py $1 $2 $3
+python /main.py $1 $2 "$3"

main.py

@@ -5,6 +5,7 @@
 
 token = sys.argv[1]
 endpoint = sys.argv[2]
+exclude = sys.argv[3]
 codeql_languages = ["cpp", "csharp", "go", "java", "javascript", "python", "ruby"]
 
 
@@ -22,10 +23,19 @@ def build_languages_list(languages):
             languages[i] = ("csharp")
         if languages[i] == "c++":
             languages[i] = ("cpp")
+        if languages[i] == "c":
+            languages[i] = ("cpp")
 
     intersection = list(set(languages) & set(codeql_languages))
     return intersection
 
+# return a list of objects from language list if they are not in the exclude list
+def exclude_languages(language_list):
+    excluded = [x.strip() for x in exclude.split(',')]
+    output = list(set(language_list).difference(excluded))
+    print("languages={}".format(output))
+    return output
+
 # Set the output of the action
 def set_action_output(output_name, value) :
     if "GITHUB_OUTPUT" in os.environ :
@@ -35,7 +45,8 @@ def set_action_output(output_name, value) :
 
 def main():
     languages = get_languages()
-    output = build_languages_list(languages)
+    language_list = build_languages_list(languages)
+    output = exclude_languages(language_list)
     set_action_output("languages", json.dumps(output))
 
 if __name__ == '__main__':