github / github/codeql

[C#] General issue: CodeQL scanner encounters issues without reporting them

Abierto
#20,353 2 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the issue**

I set up CodeQL scanning using default configurations in a private repository. When scanning the C# code, it reports that it had a low quality scan due to issues, and recommends resolving those issues. However, when I check the status page there are no other issues reported.

Image

Looking at the actions logs reveals the same situation:

```
CodeQL scanned 630 out of 630 C# files in this invocation. Check the status page for overall coverage information: https://github.com/**********/********/security/code-scanning/tools/CodeQL/status/
Analysis produced the following diagnostic information:
##[group]C# analysis with build-mode 'none' completed (1 result)
* C# analysis with build-mode 'none' completed.
##[endgroup]
##[group]Low C# analysis quality (1 result)
* Scanning C# code completed successfully, but the scan encountered issues. This may be caused by problems identifying dependencies or use of generated source code, among other reasons -- see other CodeQL diagnostics reported on the CodeQL status page for more details of possible causes. Addressing these warnings is advisable to avoid false-positive or missing results. If they cannot be addressed, consider scanning C# using either the `autobuild` or `manual` [build modes](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#comparison-of-the-build-modes).
##[endgroup]
##[group]C# was extracted with build-mode set to 'none' (1 result)
* C# was extracted with build-mode set to 'none'. This means that all C# source in the working directory will be scanned, with build tools, such as NuGet and dotnet CLIs, only contributing information about external dependencies.
##[endgroup]

##[group]Uploading code scanning results
```

There doesn't seem to be any information in the output showing what the issues it encountered were or how to fix them.

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Empieza reproduciendo el análisis predeterminado de CodeQL para C# con el modo de compilación 'none' y compara los registros de Actions con la página de estado de code-scanning. Investiga por qué el diagnóstico low-quality-scan no expone los problemas subyacentes ni los detalles para corregirlos. Se considera completado cuando los problemas encontrados se notifican con información práctica o el comportamiento se documenta como esperado.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
csharp
Área
security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Necesita aclaración
Aptitud para principiantes
30/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.