github / github/codeql

Accessing private maven repo using default GitHub configuration

Aberta
#16,674 7 comentários 0 reações 0 responsáveis Ver no GitHub
question
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

**Description of the issue**

We've been using the advanced configuration option for GitHub for awhile now with no issues. With all of the improvements made to the default configuration option, I wanted to experiment with it to simplify management of our CodeQL configuration. I switched from advanced to default and created a branch that eliminated our CodeQL workflow and configuration file to test it out.

The default CodeQL check triggered and appears to have scanned the code successfully. However, when I view the results under `Security | Code scanning | Tools | CodeQL (Default setup) | View configuration`, warnings appear that CodeQL was unable to extract dependency information from gradle.

![image](https://github.com/github/codeql/assets/840944/da710e1d-a7e7-49fe-9c42-86d47a7542c2)

After further investigation this appears to be caused by the fact that our project uses a private maven repo for retrieving dependencies and the CodeQL workflow does not have access to these credentials. Is there a way to fix this or is my only option to stick with the advanced configuration? If the latter, any chance support for this might be added?

Guia de contribuição

Abrir o guia de contribuição

Direção de pesquisa

Start by investigating the default CodeQL setup's Gradle dependency extraction with a project that uses a private Maven repository, then review how credentials are made available to that workflow. Done means dependency information is extracted successfully with private-repository credentials, or the supported limitation and workaround are documented.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Domínio
build-system
Tipo de issue
Funcionalidade
Dificuldade
5/5
Tempo estimado
Mais de uma semana
Status de atividade
Estagnada
Clareza
Precisa de esclarecimento
Facilidade para iniciantes
25/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.