dotnet / dotnet/dotnet-buildtools-prereqs-docker

Missing CodeQL scans

Open
#1,511 1 comment 0 reactions 0 assignees View on GitHub
untriaged
Dominant language
Dockerfile
Stars
87
Forks
118
Avg merge
10h 26m
Merged PRs (30d)
4

Description

There have been no recent CodeQL scans for this repo's pipeline. This causes S360 violations as there need to be regular pipeline runs to produce new CodeQL scan updates.

Due to the nature of the repo, there is no compilable code, except for the tests which are [currently excluded from scanning](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/pull/1505). Because there's no compilable code, CodeQL's scan doesn't produce any output.

This is illustrated by the following output of the `CodeQL Finalize` step:
`##[warning]Database failed to finalize or no source code was built!`

I think the right thing to do is to undo the changes in https://github.com/dotnet/dotnet-buildtools-prereqs-docker/pull/1505. And then ensure the test project gets built by the pipeline. This could be done in the `PreBuildValidation` job which is currently [skipped](https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/245a4959bac7e616a5b0406145d1e1a1239ae891/eng/common/templates/jobs/test-images-linux-client.yml#L20) because `testScriptPath` is set to empty: https://github.com/dotnet/dotnet-buildtools-prereqs-docker/blob/245a4959bac7e616a5b0406145d1e1a1239ae891/eng/pipelines/variables/common.yml#L34-L35

So we could introduce a PowerShell script that would get run in that job and build/run the test project. This would also potentially mean we would get rid of the GitHub workflow which runs the tests.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.