dotnet / dotnet/dotnet-buildtools-prereqs-docker
Missing CodeQL scans
- Dominant language
- Dockerfile
- Stars
- 87
- Forks
- 118
- Avg merge
- 10h 26m
- Merged PRs (30d)
- 4
Description
There have been no recent CodeQL scans for this repo's pipeline. This causes S360 violations as there need to be regular pipeline runs to produce new CodeQL scan updates.
Due to the nature of the repo, there is no compilable code, except for the tests which are [currently excluded from scanning](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/pull/1505). Because there's no compilable code, CodeQL's scan doesn't produce any output.
This is illustrated by the following output of the `CodeQL Finalize` step:
`##[warning]Database failed to finalize or no source code was built!`
I think the right thing to do is to undo the changes in https://github.com/dotnet/dotnet-buildtools-prereqs-docker/pull/1505. And then ensure the test project gets built by the pipeline. This could be done in the `PreBuildValidation` job which is currently [skipped](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/245a4959bac7e616a5b0406145d1e1a1239ae891/eng/common/templates/jobs/test-images-linux-client.yml#L20) because `testScriptPath` is set to empty: https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/245a4959bac7e616a5b0406145d1e1a1239ae891/eng/pipelines/variables/common.yml#L34-L35
So we could introduce a PowerShell script that would get run in that job and build/run the test project. This would also potentially mean we would get rid of the GitHub workflow which runs the tests.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.