apache / apache/cloudstack

Use separate CodeQL workflow files for each language

未關閉
#11,655 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
component:github-actions long-term-plan status:Help-wanted
主要語言
Java
星號
3.1k
分支
1.4k
平均合併
6 天 19 小時
30 天內合併 PR
32

描述

Discussion below:

> Do we need to add more languages here?

Let us get this PR merged first before we add more languages and checks.

For example if we add the Java language to the matrix we may also need to implement "paths" or only run the Java CodeQL check when certain files change. These checks can sometimes take a while to run on the CI.

Also it is probably best to separate each language that we want to check into its own CodeQL workflow file and add all the "paths". For example:

- java-codeql-analysis.yml
- python-codeql-analysis.yml
- actions-codeql-analysis.yml
- etc

Using separate CodeQL workflow files for each language in a multi-language repository allows for tailored analysis and build processes. This approach is particularly useful when languages have different build requirements or when you want to apply specific queries or configurations to individual languages.

Our current analysis file:

https://github.com/apache/cloudstack/blob/main/.github/workflows/codeql-analysis.yml

_Originally posted by @jbampton in https://github.com/apache/cloudstack/pull/11300#discussion_r2352998006_

貢獻指南

開啟貢獻指南

研究方向

從 .github/workflows/codeql-analysis.yml 和 pull request 11300 的討論開始。確認目前涵蓋的語言,以及應觸發各項檢查的檔案路徑。完成的標準是每種語言都有自己的 CodeQL 工作流程檔案,並包含適當的路徑和語言專用設定。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
github-actions, java, python
領域
ci-cd, security
Issue 類型
功能
難度
3/5
預估耗時
1-2 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。