[C#] General issue: CodeQL scanner encounters issues without reporting them
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
**Description of the issue**
I set up CodeQL scanning using default configurations in a private repository. When scanning the C# code, it reports that it had a low quality scan due to issues, and recommends resolving those issues. However, when I check the status page there are no other issues reported.
Looking at the actions logs reveals the same situation:
```
CodeQL scanned 630 out of 630 C# files in this invocation. Check the status page for overall coverage information: https://github.com/**********/********/security/code-scanning/tools/CodeQL/status/
Analysis produced the following diagnostic information:
##[group]C# analysis with build-mode 'none' completed (1 result)
* C# analysis with build-mode 'none' completed.
##[endgroup]
##[group]Low C# analysis quality (1 result)
* Scanning C# code completed successfully, but the scan encountered issues. This may be caused by problems identifying dependencies or use of generated source code, among other reasons -- see other CodeQL diagnostics reported on the CodeQL status page for more details of possible causes. Addressing these warnings is advisable to avoid false-positive or missing results. If they cannot be addressed, consider scanning C# using either the `autobuild` or `manual` [build modes](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#comparison-of-the-build-modes).
##[endgroup]
##[group]C# was extracted with build-mode set to 'none' (1 result)
* C# was extracted with build-mode set to 'none'. This means that all C# source in the working directory will be scanned, with build tools, such as NuGet and dotnet CLIs, only contributing information about external dependencies.
##[endgroup]
##[group]Uploading code scanning results
```
There doesn't seem to be any information in the output showing what the issues it encountered were or how to fix them.
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Inizia riproducendo la scansione CodeQL predefinita per C# con la modalità di build 'none' e confronta i log di Actions con la pagina di stato di code-scanning. Indaga sul motivo per cui la diagnostica low-quality-scan non espone i problemi sottostanti né i dettagli per la correzione. Il lavoro è considerato completato quando i problemi riscontrati vengono segnalati con informazioni utili per intervenire, oppure quando il comportamento viene documentato come previsto.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- csharp
- Ambito
- security
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Da chiarire
- Idoneità per principianti
- 30/100