Analyze the Java code CodeQL sees compiled - #9
Merged
Merged
Conversation
With build-mode none CodeQL scans every Java file in the checkout, and this repository keeps 54 of them in src/test/resources: the test projects the formatter runs on, which declare the same classes over and over (HelloWorld1 alone 26 times). The build step copied them once more into target/test-classes. CodeQL keeps one file per fully-qualified class name, so the main branch reported 104 clashing files filtered out and 23 of 73 Java files scanned. Java now uses build-mode manual: CodeQL analyzes what the existing `mvn clean test-compile` step compiles, which is the plugin's main and test sources and the generated HelpMojo. The test projects are copied as resources and never compiled, so none of them reaches the scan. The build step runs only for that leg; the actions leg keeps build-mode none and needs no Maven.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CodeQL run on main scanned 23 of 73 Java files. With
build-mode: noneCodeQL scans every Javafile in the checkout, and 54 of them are the test projects in
src/test/resources: formatter inputsthat declare the same classes over and over (
HelloWorld1alone 26 times). The build step copied themonce more into
target/test-classes. CodeQL keeps one file per fully-qualified class name, and the logsaid so: "104 files defined a class that clashes with the fully-qualified name of another scanned
class".
build-mode: manual: CodeQL analyzes what the existingmvn clean test-compilestepcompiles, which is the plugin's 16 main sources, the generated
HelpMojoand the 3 test classes. Thetest projects are only copied as resources, so none of them reaches the scan.
actionsleg keepsbuild-mode: noneand needs no Maven.The analysis log of this pull request's run says how many files were scanned ("CodeQL scanned N out of
M Java files"); the status page follows once it runs on main.