chore: Enable codeql action #2982
Conversation
This action runs GitHub's industry-leading semantic code analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast
|
Hi @naveensrinivasan, |
There was a problem hiding this comment.
Hey @naveensrinivasan, thanks for the contribution! I left a few comments below.
I think that |
|
According to the action.ym' there is no default language specified for the action |
|
I meant it is specified by default in the template, sorry for the confusion. |
This should be good now. Let me know! Thanks |
|
Already found issues! |
|
Hey @naveensrinivasan, thanks for the quick fix! This is already showing some very helpful vulnerabilities. Could you also disable the cypress and dist folders as those are our builds and tests? |
TBH I don't know if it possible. The way to address that is in the security setting to ignore those alerts. |
You have to specify https://github.com/Yash-Singh1/zoom.js/blob/10110b78283a9fce247aadc9469dd9cf3c096226/.github/codeql/codeql-config.yml |
naveensrinivasan
force-pushed
the
naveensrinivasan/codeql
branch
from
431036f
to
40a3ea5
Compare
@Yash-Singh1 Thanks, I wasn't aware of that option. I have updated it. |
Signed-off-by: naveensrinivasan <172697 [email protected]>
naveensrinivasan
force-pushed
the
naveensrinivasan/codeql
branch
from
40a3ea5
to
0b461b5
Compare
This action runs GitHub's industry-leading semantic code analysis engine, CodeQL, against a repository's source code to find security vulnerabilities.
https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql
https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast