Add CodeQL SAST #952
Add CodeQL SAST #952
Conversation
.github/workflows/codeql.yml
Outdated
| actions: read | ||
| contents: read |
There was a problem hiding this comment.
According to the documentation, this is only needed for private repos...
There was a problem hiding this comment.
Sorry, I don't follow. Permissions: at all or some specific right?
There was a problem hiding this comment.
According to the CodeQL Github Actions README file:
There was a problem hiding this comment.
I see. I'll remove it.
.github/workflows/codeql.yml
Outdated
| # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] | ||
| # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support |
There was a problem hiding this comment.
We can probably remove this comment?
There was a problem hiding this comment.
It were just some hints for the future, but if you prefer clean code, sure.
| matrix: | ||
| language: [ 'cpp' ] |
There was a problem hiding this comment.
is matrix needed here? there's only one language...
There was a problem hiding this comment.
Makes it easier to add additional languages if one day you would like to scan python too for example.
There was a problem hiding this comment.
I don't think we'll need to examine the python code because it's mostly for tests or configuration, but we can keep it as is
|
@sashashura the build is failing because CodeQL check fail: These errors should be ignored because PcapPlusPlus uses these to parse SSL/TLS packets. However I'm not sure there is a way to suppress/ignore errors on specific lines as this issue says: github/codeql#9298 (comment) Should we add |
|
Interesting behavior. From my experience all security issues found by a codeql.yml already merged in repository are placed in Security tab and are visible only to maintainers. It is easy to click a button and suppress specific warnings there if they are false. |
There was a problem hiding this comment.
@sashashura the next step would be to add a badge to README.md, and then let it run for some time. If CodeQL is stable and works as expected we can probably remove LGTM
CodeQL is the continuation LGTM. It integrates into GitHub Security tab and is more configurable. I have set it up to scan only for C++ issues.