github / github/codeql

Questions to workflow integration

Đang mở
#4,426 4 bình luận 1 reaction 0 người được giao Xem trên GitHub
question
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

Hi CodeQL people!

Regarding CodeQL@GitHUB via Workflows/Actions, I have four questions that I hope you can help answer, or direct me to the right place to ask these questions.

1) Is it possible to exclude a rule?

The use-case is that a project might disagree with some style-recommendations, e.g. "cpp/trivial-switch".
Would it be possible to have a config along the lines of:

```
name: "CodeQL config"

disable-default-queries: false

queries:
- uses: security-and-quality
exclude: cpp/trivial-switch
```

Is something like that possible?

One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome when a project generally disagree on certain code-styles and dogmas.

2) Adding the above question, is there an extensive documentation on all options of the CodeQL config-file somewhere?

3) Is it possible to ignore parts of a statically compiled codebase?

When adding "paths" and "paths-ignore", the scanner informs that those options are only for interpreted languages.
Is there any way to have the same functionality for static compiled languages?

The use-case is that a project might have third-party code, possibly via submodules, or code for which scanning is not wanted.
One can go and filter out "post-scan" by setting to "won't fix", however, that can be very cumbersome especially when contributions arrive via PR which the scanner rejects due to some completely unrelated third-party code already known to the project maintainer.

4) When using CodeQL via lgtm.com one could get a neat "code-quality" badge to put on the project README.
Is a similar thing available with the security scans?

Thanks!
Simon

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.