Enable codeql scanning#1532
Conversation
|
|
||
| jobs { | ||
| for (scan in scans) { | ||
| ["analyze-\(scan.language)"] { |
There was a problem hiding this comment.
Isn't it better/easier to go with a matrix build instead of multiple jobs? 🤔 🤷♂️
It's the same outout, so it actually doesn't matter. Just my initial thought about it 😂
There was a problem hiding this comment.
Matrices feel like a poor man's for loop that we can express much more easily with Pkl. And, you get actual Pkl dot access this way, rather than a stringy typed value ("${{ matrix.language }}" vs. scan.language). I think this ends up as basically the same thing? Each turns into its own job execution regardless.
| "main" | ||
| } | ||
| } | ||
| schedule { |
There was a problem hiding this comment.
Is there a reason not to run this on push or PR? Having this able to block PRs would be very handy. I'd be interested in adding at least one custom query to block a problem pattern in CliCommand.
There was a problem hiding this comment.
I was concerned about how long these things take to run. But, we can play around with it and see what happens!
There was a problem hiding this comment.
Analysis for java-kotlin finished within a minute of the gradle-check job, so I think this would probably be okay to enable on PRs. A <1m delay in exchange for better security enforcement on PRs seems okay to me.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
4 participants
This enables security vulnerability scanning using CodeQL.