GitHub Community
[Public Beta] CodeQL can scan Java and C# projects without a build #113548
Replies: 5 comments 10 replies
-
|
Can you clarify how this works internally? Is there a new extractor that directly parses Java and Kotlin code (similar to Javascript, Typescript, and Python) or does it still try to run an autobuild and then try to analyze the instrumented results of the failed build? I tried this out on a Java repository (no Kotlin code) that had never had CodeQL enabled and noticed it still ran the autobuild action. |
Beta Was this translation helpful? Give feedback.
-
|
Let us know how things go for you! |
Beta Was this translation helpful? Give feedback.
-
|
Really excited about this new feature! @coadaflorin, is there any way to take advantage of the build-less scans if we pull dependencies through Artifactory rather than Maven central? |
Beta Was this translation helpful? Give feedback.
-
|
I would love to hear more about your use-case and setup. That is something that we are currently investigating! |
Beta Was this translation helpful? Give feedback.
-
|
Hey @coadaflorin, were you able to solve for the Artifactory use case? |
Beta Was this translation helpful? Give feedback.
-
|
Hey @Monstrosity8 we made some progress on it. We are able to use credentials to authenticate against private registries but the configuration needs to exist in the project. (i.e. if you define you private registry in a Gradle config or Maven file then we should be able to go and find those dependencies. ) |
Beta Was this translation helpful? Give feedback.
-
|
As of my last update in January 2022, CodeQL, a semantic code analysis engine developed by GitHub, allows for scanning Java projects without requiring a build. This capability enables developers to perform static analysis on Java codebases without having to compile the code first. By directly analyzing the source code, CodeQL can detect security vulnerabilities, bugs, and other issues in Java projects. |
Beta Was this translation helpful? Give feedback.
-
|
In January 2022, the statement "perform static analysis on Java codebases without having to compile the code first" was not accurate for Java which did require a manual or automated build. Starting with CodeQL |
Beta Was this translation helpful? Give feedback.
-
|
Any estimate on when this might leave public beta, and be available also for GitHub Enterprise Server? |
Beta Was this translation helpful? Give feedback.
-
|
We currently do not have a concrete date for a ship to GitHub Enterprise Server. We are going to ship this out to Enterprise Server too, we just need to complete our beta before doing so. We are happy to explore options for you to try this out during the beta. Would you mind connecting via email for a chat? My address is coadaflorin@github.com. |
Beta Was this translation helpful? Give feedback.
-
This statement and blog post was made on June 20, 2024. When will |
Beta Was this translation helpful? Give feedback.
-
|
Hi @hicksjacobp 👋 |
Beta Was this translation helpful? Give feedback.
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
A key requirement for scanning Java with CodeQL was to have a working build. We are now able to scan Java projects without the need for a working build. We really ❤️ feedback and while this feature is in a public beta we welcome feedback about this new approach for scanning Java.
June 20, 2024: CodeQL can now scan C# without a working build.
If you prefer sharing feedback directly, feel free to reach out at coadaflorin@github.com .
Who is this available for?
build-mode: noneoption to trigger this behaviour.2.16.5. Use the--build-mode noneoption to trigger this behaviour.2.17.6. Use the--build-mode noneoption to trigger this behaviour.Beta Was this translation helpful? Give feedback.
All reactions