Baseline Revision Tripwire: Definition & CodeQL Example

A baseline revision tripwire is a type of tripwire that compares a revision of a specified file with the baseline revision of that same file and looks for certain changes, e.g.:

- The addition or deletion of specific lines

- The modification or deletion of specific comments

- The modification of specific methods

- etc.

If the specified file doesn't exist or if any defined checks fail, an incident is created.

Here's an example configuration for a baseline revision tripwire in CodeQL to detect the addition or deletion of specific comments in a given source code file:

```yaml

queries:

- BaselineRevisionTripwire.ql

policies:

- name: BaselineRevisionTripwirePolicy

enabled: true

severity: Medium

query_ids:

- BaselineRevisionTripwire

conditions:

- BaselineRevisionTripwireCondition:

file: src/main/java/org/example/Service.java

comment_checks:

- match: "TODO(@[a-zA-Z0-9]+)"

```