Creates a variable for compiled languages in code scanning docs, consolidates existing autobuild variables (#37673)
Co-authored-by: Felicity Chapman <felicitymay@github.com>
This commit is contained in:
Ben Ahmady
@@ -34,8 +34,9 @@ topics:
|
||||
|
||||
## About the {% data variables.code-scanning.codeql_workflow %} and compiled languages
|
||||
|
||||
{% data variables.product.prodname_code_scanning_caps %} works by running queries against one or more databases. Each database contains a representation of all of the code in a single language in your repository.
|
||||
For the compiled languages C/C++, C#,{% ifversion codeql-go-autobuild %} Go,{% endif %}{% ifversion codeql-kotlin-beta %} Kotlin, {% endif %} and Java, the process of populating this database involves building the code and extracting data. {% data reusables.code-scanning.analyze-go %}
|
||||
{% data variables.product.prodname_code_scanning_caps %} works by running queries against one or more databases. Each database contains a representation of all of the code in a single language in your repository. For the compiled languages {% data variables.code-scanning.compiled_languages %}, the process of populating this database involves building the code and extracting data.
|
||||
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %}
|
||||
|
||||
{% ifversion code-scanning-without-workflow %}
|
||||
|
||||
|
||||
@@ -623,7 +623,7 @@ In the following example, `vars.CODEQL_CONF` is a {% data variables.product.prod
|
||||
|
||||
## Configuring {% data variables.product.prodname_code_scanning %} for compiled languages
|
||||
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %} {% data reusables.code-scanning.analyze-go %}
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %}
|
||||
|
||||
{% data reusables.code-scanning.autobuild-add-build-steps %} For more information about how to configure {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} for compiled languages, see "[AUTOTITLE](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages)."
|
||||
|
||||
|
||||
@@ -89,7 +89,7 @@ If an automatic build of code for a compiled language within your project fails,
|
||||
|
||||
- Remove the `autobuild` step from your {% data variables.product.prodname_code_scanning %} workflow and add specific build steps. For information about editing the workflow, see "[AUTOTITLE](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning#editing-a-code-scanning-workflow)." For more information about replacing the `autobuild` step, see "[AUTOTITLE](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language)."
|
||||
|
||||
- If your workflow doesn't explicitly specify the languages to analyze, {% data variables.product.prodname_codeql %} implicitly detects the supported languages in your code base. In this configuration, out of the compiled languages C/C++, C#,{% ifversion codeql-go-autobuild %} Go,{% endif %}{% ifversion codeql-swift-beta %} Java, and Swift,{% else %} and Java,{% endif %} {% data variables.product.prodname_codeql %} only analyzes the language with the most source files. Edit the workflow and add a matrix specifying the languages you want to analyze. The default {% data variables.product.prodname_codeql %} analysis workflow uses such a matrix.
|
||||
- If your workflow doesn't explicitly specify the languages to analyze, {% data variables.product.prodname_codeql %} implicitly detects the supported languages in your code base. In this configuration, out of the compiled languages {% data variables.code-scanning.compiled_languages %}, {% data variables.product.prodname_codeql %} only analyzes the language with the most source files. Edit the workflow and add a matrix specifying the languages you want to analyze. The default {% data variables.product.prodname_codeql %} analysis workflow uses such a matrix.
|
||||
|
||||
The following extracts from a workflow show how you can use a matrix within the job strategy to specify languages, and then reference each language within the "Initialize {% data variables.product.prodname_codeql %}" step:
|
||||
|
||||
|
||||
@@ -136,7 +136,7 @@ For compiled languages, {% data variables.product.prodname_codeql %} needs to in
|
||||
|
||||
{% data reusables.code-scanning.beta-kotlin-or-swift-support %}
|
||||
|
||||
The {% data variables.product.prodname_codeql_cli %} includes autobuilders for C/C++, C#, Go, {% ifversion codeql-swift-beta %} Java, and Swift{% else %} and Java{% endif %} code. {% data variables.product.prodname_codeql %} autobuilders allow you to build projects for compiled languages without specifying any build commands. When an autobuilder is invoked, {% data variables.product.prodname_codeql %} examines the source for evidence of a build system and attempts to run the optimal set of commands required to extract a database.
|
||||
The {% data variables.product.prodname_codeql_cli %} includes autobuilders for {% data variables.code-scanning.compiled_languages %} code. {% data variables.product.prodname_codeql %} autobuilders allow you to build projects for compiled languages without specifying any build commands. When an autobuilder is invoked, {% data variables.product.prodname_codeql %} examines the source for evidence of a build system and attempts to run the optimal set of commands required to extract a database.
|
||||
|
||||
An autobuilder is invoked automatically when you execute `codeql database create` for a compiled `--language` if don’t include a
|
||||
`--command` option. For example, for a Java codebase, you would simply run:
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
For these languages, {% data variables.product.prodname_codeql %} analyzes the source files in your repository that are built. For any of these languages, you can disable `autobuild` and instead use custom build commands in order to analyze only the files that are built by these custom commands.
|
||||
@@ -1 +1 @@
|
||||
For the supported compiled languages, you can use the `autobuild` action in the {% data variables.code-scanning.codeql_workflow %} to build your code. This avoids you having to specify explicit build commands for C/C++, C#,{% ifversion codeql-go-autobuild %} Go,{% endif %}{% ifversion codeql-kotlin-beta %} Kotlin, {% endif %} and Java.
|
||||
{% data variables.product.prodname_codeql %} analyzes the {% data variables.code-scanning.compiled_languages %} source files in your repository that are built. You can use the `autobuild` action in the {% data variables.code-scanning.codeql_workflow %} to build your code. Alternatively, you can disable `autobuild` and instead specify explicit build commands to analyze only the files that are built by these custom commands.
|
||||
@@ -8,3 +8,6 @@ codeql_workflow: 'CodeQL analysis workflow'
|
||||
|
||||
# The tool status page
|
||||
tool_status_page: 'tool status page'
|
||||
|
||||
# List of compiled languages
|
||||
compiled_languages: 'C/C++, C#, {% ifversion codeql-go-autobuild %} Go,{% endif %} {% ifversion codeql-swift-beta %} Java, and Swift{% else %} and Java{% endif %}'
|
||||
|
||||
Reference in New Issue
Block a user