github / github/roadmap

Improved incremental CodeQL analysis during Pull Requests for Ruby and Java [GA]

未关闭
#1,158 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
GHES 3.22 GitHub Advanced Security (GHAS) Shipped
主要语言
没有语言数据
星标
8.9k
派生
1.8k
PR 合并指标
30 天内没有已合并 PR

描述

### Value Prop

CodeQL is the static analysis engine that powers GitHub’s code scanning capabilities. In Pull Requests, it can pinpoint potential vulnerabilities and deliver detailed insights alongside automated remediation suggestions through [Copilot Autofix](https://github.blog/news-insights/product-news/secure-code-more-than-three-times-faster-with-copilot-autofix). With this update, CodeQL [queries](https://codeql.github.com/docs/writing-codeql-queries/about-codeql-queries/) and extraction will focus exclusively on newly introduced code rather than rescanning the entire codebase, streamlining the analysis process.

### Expected Outcome

Developers receive even faster feedback during Pull Requests, reducing the time needed to identify and fix emerging vulnerabilities. This speed enhancement aims to make a significant reduction in scan duration with a potential small impact on accuracy on the Pull Requests page. This will help accelerate the remediation process, enabling teams to secure their code more efficiently without slowing down for security.

贡献指南

打开贡献指南

调研方向

从 CodeQL 查询文档和提取过程的描述开始,然后确定 Ruby 和 Java 的增量 Pull Request 分析在哪里实现。完成的标准是:在不重新扫描整个代码库的情况下分析新引入的代码,同时提供更快的反馈,并了解对准确性的任何影响。

由索引模型根据 Issue 内容生成。

评估

技术栈
java, ruby
领域
security
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
冷清
描述清晰度
需要澄清
新手友好度
20/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。