Questions to workflow integration
- Linguagem predominante
- CodeQL
- Estrelas
- 10.1k
- Forks
- 2.1k
- Merge médio
- 2d 15h
- PRs com merge (30d)
- 141
Descrição
Hi CodeQL people!
Regarding CodeQL@GitHUB via Workflows/Actions, I have four questions that I hope you can help answer, or direct me to the right place to ask these questions.
1) Is it possible to exclude a rule?
The use-case is that a project might disagree with some style-recommendations, e.g. "cpp/trivial-switch".
Would it be possible to have a config along the lines of:
```
name: "CodeQL config"
disable-default-queries: false
queries:
- uses: security-and-quality
exclude: cpp/trivial-switch
```
Is something like that possible?
One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome when a project generally disagree on certain code-styles and dogmas.
2) Adding the above question, is there an extensive documentation on all options of the CodeQL config-file somewhere?
3) Is it possible to ignore parts of a statically compiled codebase?
When adding "paths" and "paths-ignore", the scanner informs that those options are only for interpreted languages.
Is there any way to have the same functionality for static compiled languages?
The use-case is that a project might have third-party code, possibly via submodules, or code for which scanning is not wanted.
One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome especially when contributions arrive via PR which the scanner rejects due to some completely unrelated third-party code already known to the project maintainer.
4) When using CodeQL via lgtm.com one could get a neat "code-quality" badge to put on the project README.
Is a similar thing available with the security scans?
Thanks!
Simon
Guia de contribuição
Avaliação
Esta issue ainda não foi avaliada.