-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add CodeQL workflow #1294
base: master
Are you sure you want to change the base?
Add CodeQL workflow #1294
Conversation
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this is a good improvement to CI/checks/etc.
The only thing that catches my mind - it only checks one OS-specific backend/implementation - Linux/Ubuntu.
I believe it worth extending this script to check at least Windows/macOS too (not to mention BSD, etc.).
+1 from my side.
Yes I agree that this is a good improvement to have. And I agree that it would be good to extend to Windows and macOS. |
This PR should also help to address existing feature request I raised earlier this year. |
👋 Sorry for missing your reply. Yes, CodeQL works under Windows and MacOS-based runners. You can specify the |
I think we can merge this first and then add Windows and macOS later. |
Co-authored-by: Ihor Dutchak <ihor.youw@gmail.com>
Hello from GitHub Security Lab!
Your repository is critical to the security of the Open Source Software (OSS) ecosystem, and as part of our mission to make OSS safer, we are contributing a CodeQL configuration for code scanning to your repository. By enabling code scanning with CodeQL, you will be able to continuously analyze your code and surface potential vulnerabilities before they can even reach your codebase.
We’ve tested the configuration manually before opening this pull request and adjusted it to the needs of your particular repository, but feel free to tweak it further! Check this page for detailed documentation.
Questions? Check out the FAQ below!
FAQ
Click here to expand the FAQ section
How often will the code scanning analysis run?
By default, code scanning will trigger a scan with the CodeQL engine on the following events:
What will this cost?
Nothing! The CodeQL engine will run inside GitHub Actions, making use of your unlimited free compute minutes for public repositories.
Where can I see the results of the analysis?
The results of the analysis will be available on the Security tab of your repository. You can find more information about the results here.
For Pull Requests, you can find the results of the analysis in the Checks tab. You can find more information about the Pull Request results here.
What types of problems does CodeQL find?
CodeQL queries are hosted in the
github/codeql
repository.By default, code scanning runs the
default
query suite. The queries in thedefault
query suite are highly precise and return few false positive code scanning results.If you are looking for a more comprehensive analysis, which could return a greater number of false positives, you can enable the
security-extended
query suite in thequeries
option ofgithub/codeql-action/init
.In the event of finding a false positive, please create a false positive Issue in
github/codeql
so we can investigate and improve the query in question. You can also contribute to the query by opening a pull request againstgithub/codeql
.How do I customize the analysis?
You can customize the analysis by using a CodeQL configuration file. This way, you can specify which queries should [not] be run, and/or which files should be excluded from the analysis. You can find more information about the configuration file here.
How do I upgrade my CodeQL engine?
No need! New versions of the CodeQL analysis are constantly deployed on GitHub.com; your repository will automatically benefit from the most recently released version.
The analysis doesn’t seem to be working
If you get an error in GitHub Actions that indicates that CodeQL wasn’t able to analyze your code, please follow the instructions here to debug the analysis.
Which source code hosting platforms does code scanning support?
GitHub code scanning is deeply integrated within GitHub itself. If you’d like to scan source code that is hosted elsewhere, we suggest that you create a mirror of that code on GitHub.