github / github/codeql

CI: Ignore path for compiled languages

Open
#5,618 9 comments 1 reaction 0 assignees View on GitHub
acknowledged enhancement
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

**Description of the issue**

I have implemented CodeQL scanning in workflow for [this](https://github.com/soumyamahunt/Notepads) project. It is a UWP app that uses xaml for UI and also uses additional tools like [cppwinrt](https://github.com/microsoft/cppwinrt). When CodeQL scanning is performed CodeQL produces alerts for [xaml compiler generated files](https://github.com/soumyamahunt/Notepads/security/code-scanning/688?query=ref%3Arefs%2Fheads%2Fadvanced-activation) and [cppwinrt generated header files](https://github.com/soumyamahunt/Notepads/security/code-scanning/4951?query=ref%3Arefs%2Fheads%2Fadvanced-activation). Since these kind of files that are generated by build tools aren't maintained by individual project maintainers it doesn't make sense to get code quality analysis for them (getting security analysis is fine). Is there anyway I can restrict analysis done for these kind of files??

**Additional Details**

Right now I am using [this](https://github.com/soumyamahunt/Notepads/blob/advanced-activation/.github/workflows/csa-bulk-dismissal.yml) workflow to manually dismiss these kind of alerts. However I want to automate it as soon as `Code scanning results` is published. Is there any way I can automate this??

![msedge_rpCDtTtdVW](https://user-images.githubusercontent.com/51203900/113818437-62e49180-9795-11eb-9ec2-a847d929e152.png)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.