apache / apache/cloudstack

Use separate CodeQL workflow files for each language

未关闭
#11,655 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
component:github-actions long-term-plan status:Help-wanted
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

Discussion below:

> Do we need to add more languages here?

Let us get this PR merged first before we add more languages and checks.

For example if we add the Java language to the matrix we may also need to implement "paths" or only run the Java CodeQL check when certain files change. These checks can sometimes take a while to run on the CI.

Also it is probably best to separate each language that we want to check into its own CodeQL workflow file and add all the "paths". For example:

- java-codeql-analysis.yml
- python-codeql-analysis.yml
- actions-codeql-analysis.yml
- etc

Using separate CodeQL workflow files for each language in a multi-language repository allows for tailored analysis and build processes. This approach is particularly useful when languages have different build requirements or when you want to apply specific queries or configurations to individual languages.

Our current analysis file:

https://github.com/apache/cloudstack/blob/main/.github/workflows/codeql-analysis.yml

_Originally posted by @jbampton in https://github.com/apache/cloudstack/pull/11300#discussion_r2352998006_

贡献指南

打开贡献指南

调研方向

从 .github/workflows/codeql-analysis.yml 和 pull request 11300 的讨论开始。确定当前涵盖的语言,以及应触发每项检查的文件路径。完成的标准是每种语言都有自己的 CodeQL 工作流文件,并包含适当的路径和特定于语言的配置。

由索引模型根据 Issue 内容生成。

评估

技术栈
github-actions, java, python
领域
ci-cd, security
Issue 类型
功能
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。