Skip to content

Commit b90c591

Browse files
authored
Update compiled-languages-csharp.md
1 parent 9f8c476 commit b90c591

File tree

1 file changed

+24
-4
lines changed

1 file changed

+24
-4
lines changed

troubleshooting/codeql-builds/compiled-languages-csharp.md

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -238,11 +238,11 @@ Start here: [CodeQL Docs - The build takes too long](https://docs.github.com/en
238238

239239

240240
## Optimization - Removing Code From Scans
241-
Consider excluding any code you do not wish to include in a security scan to speed up and remove noise from this process. This is commonly employed for unit tests, demo code, or code that would not benefit from being scanned (ex: DacPacs).
241+
Consider removing any code you do not wish to include in a security scan to both speed up and remove noise from this process. This is commonly employed for unit tests, demo code, and code that would not benefit from being scanned (ex: DacPacs).
242242

243243
### `build-mode: none`
244244

245-
[Build-mode none](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes) has added support for CodeQL [configuration paths filters](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan) for this compiled language. Since this mode only will recursively look for `.cs` files throughout the codebase to scan, we can be a bit more prescriptive in our config:
245+
[Build-mode none](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes) has added support for CodeQL [configuration paths filters](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan) for this compiled language. This mode will recursively walk the filesystem to look for `.cs` files throughout the codebase to scan. We can be a bit more prescriptive in our configuration instructing the enginge to include/exclude by `paths` / `paths-ignore` globs:
246246

247247
```yaml
248248
- uses: github/codeql-action/init@v3
@@ -262,15 +262,15 @@ Start here: [CodeQL Docs - The build takes too long](https://docs.github.com/en
262262
263263
Tip: ensure credentials to your private registries listed in your `nuget.config` are available/injected so that `none` mode does not attempt to hit a registry that will fail for every dependency.
264264

265-
Alternatively, you might consider breaking up code into smaller chunks to scan. In a monorepo with many microservices, it might make sense to only scan dependent code together. CodeQL has natural boundaries at the network layer - if a direct method call is not invoked then there is little value in scanning the code together. Consider specifying a folder to scan (vs ignore)
265+
Alternatively, you might consider breaking up code into smaller chunks to scan. For example, a monorepo with many microservices would be a prime candidate to scan only the dependent code together. CodeQL has natural boundaries at the network layer - if a direct method call is not invoked then there is reduced value in scanning the code together. Consider specifying services by folder to scan together (vs ignore):
266266

267267
```yaml
268268
- uses: github/codeql-action/init@v3
269269
with:
270270
languages: ${{ matrix.language }}
271271
build-mode: none
272272
config: |
273-
paths-ignore:
273+
paths:
274274
- '**/MicroserviceA/**'
275275
- '**/Framework/**'
276276
@@ -280,6 +280,26 @@ Alternatively, you might consider breaking up code into smaller chunks to scan.
280280
with:
281281
category: "/language:${{matrix.language}}/MicroserviceA"
282282
```
283+
+
284+
285+
```yaml
286+
- uses: github/codeql-action/init@v3
287+
with:
288+
languages: ${{ matrix.language }}
289+
build-mode: none
290+
config: |
291+
paths:
292+
- '**/MicroserviceB/**'
293+
- '**/Framework/**'
294+
295+
# If scanning more than one analysis per repo - ensure you upload results with a unique category
296+
- name: Perform CodeQL Analysis
297+
uses: github/codeql-action/analyze@v3
298+
with:
299+
category: "/language:${{matrix.language}}/MicroserviceB"
300+
```
301+
302+
283303

284304
### `build-mode: autobuild` or `build-mode: manual`
285305

0 commit comments

Comments
 (0)