Description
Hi CodeQL people!
Regarding CodeQL@GitHUB via Workflows/Actions, I have four questions that I hope you can help answer, or direct me to the right place to ask these questions.
- Is it possible to exclude a rule?
The use-case is that a project might disagree with some style-recommendations, e.g. "cpp/trivial-switch".
Would it be possible to have a config along the lines of:
name: "CodeQL config"
disable-default-queries: false
queries:
- uses: security-and-quality
exclude: cpp/trivial-switch
Is something like that possible?
One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome when a project generally disagree on certain code-styles and dogmas.
-
Adding the above question, is there an extensive documentation on all options of the CodeQL config-file somewhere?
-
Is it possible to ignore parts of a statically compiled codebase?
When adding "paths" and "paths-ignore", the scanner informs that those options are only for interpreted languages.
Is there any way to have the same functionality for static compiled languages?
The use-case is that a project might have third-party code, possibly via submodules, or code for which scanning is not wanted.
One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome especially when contributions arrive via PR which the scanner rejects due to some completely unrelated third-party code already known to the project maintainer.
- When using CodeQL via lgtm.com one could get a neat "code-quality" badge to put on the project README.
Is a similar thing available with the security scans?
Thanks!
Simon