CodeQL Seems to Scan Maven Target Folder by Default

[SudharakaP]

I was integrating CodeQL action on a repo which has maven and npm builds. It seems to me that for maven CodeQL seems to also scan the target directory by default which seems to take a long time (approximately 30 mins). Here are the CodeQL runs;

https://github.com/jhipster/jhipster-online/actions?query=workflow%3ACodeQL

I was wondering if there's a way to exclude the target folder? Or am I missing something here. 😄

[robertbrignull]

For Java, CodeQL will extract any code that is compiled. So the way to reduce how much code is extracted is to reduce the amount that is compiled to only the bits you want.

From the logs, here's how long the various steps took:

• java extraction: 5:32
• javascript extraction: 5:19
• java queries: 1:09
• javascript queries: 15:12

So it's actually javascript that's taking the majority of the time. I couldn't actually find any reference to Maven doing much in the target directory. I could find a bunch of javascript files being extracted from there. If you want to exclude files from javascript extraction then you can add a config file, although note that excluding directories in this way only affects javascript and python right now, see https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#specifying-directories-to-scan

The following config file should work:

- paths-ignore:
  - target

[SudharakaP]

@robertbrignull : Thanks a lot. Yes my mistake it was the JavaScript side that was taking the majority of the time and when added the paths-ignore it seems to dramatically improve the processing times. Appreciate your response and the informatino provided. 😄