setup-python-dependencies Seems to Be Ignored

[jimmybrancaccio]

Hi all,

I am currently running this action but it seems to be ignoring the setup-python-dependencies: false directive. Here's my workflow file:

name: "CodeQL Analysis"

on:
  push:
    branches: [master, ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
  schedule:
    - cron: '0 20 * * 1'
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze Code
    runs-on: self-hosted
    container:
      image: python:3.9.0-buster

    steps:
    # Check out the Git repository.
    - name: Checkout Repository
      uses: actions/checkout@v2
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
        fetch-depth: 2

    # If this run was triggered by a pull request event, then checkout
    # the head of the pull request instead of the merge commit.
    - run: git checkout HEAD^2
      if: ${{ github.event_name == 'pull_request' }}

    # Install Python Dependencies
    - name: Install Python Dependencies
      run: if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v1
      # Override language selection by uncommenting this and choosing your languages
      with:
      #   languages: go, javascript, csharp, python, cpp, java
        setup-python-dependencies: false

    # Analyze the code!
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v1

It works, but I get a warning about the CodeQL - "We were unable to install your python dependencies. You can call this action with 'setup-python-dependencies: false' to disable this process."

Any ideas? Thanks!

[Daverlo]

This should be fixed now!

BTW if you want CodeQL to be aware of your dependencies you need to set the CODEQL_PYTHON environment variable and point it at your python installation, in this case it should point to which python

https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#analyzing-python-dependencies

[jimmybrancaccio]

Awesome thanks @Daverlo! I did actually try using the CODEQL_PYTHON variable during all my fiddling around but never got it to work properly. I'll have to see if I can try it again though!