github / github/codeql

Questions to workflow integration

Abierto
#4,426 4 comentarios 1 reacción 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

Hi CodeQL people!

Regarding CodeQL@GitHUB via Workflows/Actions, I have four questions that I hope you can help answer, or direct me to the right place to ask these questions.

1) Is it possible to exclude a rule?

The use-case is that a project might disagree with some style-recommendations, e.g. "cpp/trivial-switch".
Would it be possible to have a config along the lines of:

```
name: "CodeQL config"

disable-default-queries: false

queries:
- uses: security-and-quality
exclude: cpp/trivial-switch
```

Is something like that possible?

One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome when a project generally disagree on certain code-styles and dogmas.

2) Adding the above question, is there an extensive documentation on all options of the CodeQL config-file somewhere?

3) Is it possible to ignore parts of a statically compiled codebase?

When adding "paths" and "paths-ignore", the scanner informs that those options are only for interpreted languages.
Is there any way to have the same functionality for static compiled languages?

The use-case is that a project might have third-party code, possibly via submodules, or code for which scanning is not wanted.
One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome especially when contributions arrive via PR which the scanner rejects due to some completely unrelated third-party code already known to the project maintainer.

4) When using CodeQL via lgtm.com one could get a neat "code-quality" badge to put on the project README.
Is a similar thing available with the security scans?

Thanks!
Simon

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.