setup-python-dependencies Seems to Be Ignored

[jimmybrancaccio]

Hi all,

I am currently running this action but it seems to be ignoring the setup-python-dependencies: false directive. Here's my workflow file:

name: "CodeQL Analysis"

on:
 push:
 branches: [master, ]
 pull_request:
 # The branches below must be a subset of the branches above
 branches: [master]
 schedule:
 - cron: '0 20 * * 1'
 workflow_dispatch:

jobs:
 analyze:
 name: Analyze Code
 runs-on: self-hosted
 container:
 image: python:3.9.0-buster

 steps:
 # Check out the Git repository.
 - name: Checkout Repository
 uses: actions/checkout@v2
 with:
 # We must fetch at least the immediate parents so that if this is
 # a pull request then we can checkout the head.
 fetch-depth: 2

 # If this run was triggered by a pull request event, then checkout
 # the head of the pull request instead of the merge commit.
 - run: git checkout HEAD^2
 if: ${{ github.event_name == 'pull_request' }}

 # Install Python Dependencies
 - name: Install Python Dependencies
 run: if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

 # Initializes the CodeQL tools for scanning.
 - name: Initialize CodeQL
 uses: github/codeql-action/init@v1
 # Override language selection by uncommenting this and choosing your languages
 with:
 # languages: go, javascript, csharp, python, cpp, java
 setup-python-dependencies: false

 # Analyze the code!
 - name: Perform CodeQL Analysis
 uses: github/codeql-action/analyze@v1

It works, but I get a warning about the CodeQL - "We were unable to install your python dependencies. You can call this action with 'setup-python-dependencies: false' to disable this process."

Any ideas? Thanks!

[Daverlo]

This should be fixed now!

BTW if you want CodeQL to be aware of your dependencies you need to set the CODEQL_PYTHON environment variable and point it at your python installation, in this case it should point to which python

https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#analyzing-python-dependencies

[jimmybrancaccio]

Awesome thanks @Daverlo! I did actually try using the CODEQL_PYTHON variable during all my fiddling around but never got it to work properly. I'll have to see if I can try it again though!