Migrating from LGTM, or removng it

[adrinjalali]

Discussed in #24578

^{Originally posted by haiatn October 4, 2022}
Hi,
I read LGTM will shut down and we have all PRs scanned by it,
It could be replaced with Github Code Scanning:
https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository

What do you think? Are there any limitations?

[adrinjalali]

Seems like they've moved everything to github: https://github.blog/2022-08-15-the-next-step-for-lgtm-com-github-code-scanning/

But I'm not sure how much we've actually used the results of LGTM, I don't remember a single instance myself. Should we just remove them?

[haiatn]

According to this issue #12167 it was ignored for several months when we didn't know that it stopped working.
But later when it started again it should've alerted on errors before merging and also people did open PRs to fix existing errors.

[adrinjalali]

cc @thomasjpfan @jjerphan

Thomas thinks they're useful, I'm curious as when such an incident has happened :P

[thomasjpfan]

From the pass 3-4 years, I think LGTM has not helped too much. A lot of the warnings or errors are patterns we are okay with. For example, this recommendation is something we are okay with:

From looking through all the current errors and warnings on LGTM, I think a lot of them are false positives. The hard part for contributors is to filter out all the noise.

From time to time, LGTM causes the PR's CI to fail that is unrelated to the PR.

For now, I am in favor of removing LGTM without a replacement. We can evaluate GitHub code scanning as a follow up.

[haiatn]

If so, I suggest removing it and if a need comes up we can open an new issue with alternatives

[haiatn]

Thank you all