You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: troubleshooting/codeql-builds/compiled-languages-csharp.md
+24-4Lines changed: 24 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -238,11 +238,11 @@ Start here: [CodeQL Docs - The build takes too long](https://docs.github.com/en
238
238
239
239
240
240
## Optimization - Removing Code From Scans
241
-
Consider excluding any code you do not wish to include in a security scan to speed up and remove noise from this process. This is commonly employed for unit tests, demo code, or code that would not benefit from being scanned (ex: DacPacs).
241
+
Consider removing any code you do not wish to include in a security scan to both speed up and remove noise from this process. This is commonly employed for unit tests, demo code, and code that would not benefit from being scanned (ex: DacPacs).
242
242
243
243
### `build-mode: none`
244
244
245
-
[Build-mode none](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes) has added support for CodeQL [configuration paths filters](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan) for this compiled language. Since this mode only will recursively look for `.cs` files throughout the codebase to scan, we can be a bit more prescriptive in our config:
245
+
[Build-mode none](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes) has added support for CodeQL [configuration paths filters](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan) for this compiled language. This mode will recursively walk the filesystem to look for `.cs` files throughout the codebase to scan. We can be a bit more prescriptive in our configuration instructing the enginge to include/exclude by `paths` / `paths-ignore` globs:
246
246
247
247
```yaml
248
248
- uses: github/codeql-action/init@v3
@@ -262,15 +262,15 @@ Start here: [CodeQL Docs - The build takes too long](https://docs.github.com/en
262
262
263
263
Tip: ensure credentials to your private registries listed in your `nuget.config` are available/injected so that `none` mode does not attempt to hit a registry that will fail for every dependency.
264
264
265
-
Alternatively, you might consider breaking up code into smaller chunks to scan. In a monorepo with many microservices, it might make sense to only scan dependent code together. CodeQL has natural boundaries at the network layer - if a direct method call is not invoked then there is little value in scanning the code together. Consider specifying a folder to scan (vs ignore)
265
+
Alternatively, you might consider breaking up code into smaller chunks to scan. For example, a monorepo with many microservices would be a prime candidate to scan only the dependent code together. CodeQL has natural boundaries at the network layer - if a direct method call is not invoked then there is reduced value in scanning the code together. Consider specifying services by folder to scan together (vs ignore):
266
266
267
267
```yaml
268
268
- uses: github/codeql-action/init@v3
269
269
with:
270
270
languages: ${{ matrix.language }}
271
271
build-mode: none
272
272
config: |
273
-
paths-ignore:
273
+
paths:
274
274
- '**/MicroserviceA/**'
275
275
- '**/Framework/**'
276
276
@@ -280,6 +280,26 @@ Alternatively, you might consider breaking up code into smaller chunks to scan.
0 commit comments