Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ci: Add javascript to CodeQL analysis #413

Merged
merged 2 commits into from
Jan 11, 2023
Merged

ci: Add javascript to CodeQL analysis #413

merged 2 commits into from
Jan 11, 2023

Conversation

ianlewis
Copy link
Member

Signed-off-by: Ian Lewis ianlewis@google.com

@ianlewis
ci: Add javascript to CodeQL analysis
354a46b 
Signed-off-by: Ian Lewis <ianlewis@google.com>
laurentsimon
laurentsimon approved these changes Dec 15, 2022
View reviewed changes
Copy link
Contributor

@laurentsimon laurentsimon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any thoughts on making codeQL just a daily run, and create an issue if it finds something?

@ianlewis
Copy link
Member Author

Any thoughts on making codeQL just a daily run, and create an issue if it finds something?

I'm ok with it running on PRs, esp since scorecard checks for it.

I'm really not sure why it's complaining about sourcemap-register.js since I think it's always the same but it doesn't complain on the slsa-github-generator repo... I'll check later.

@laurentsimon
Copy link
Contributor

laurentsimon commented Dec 15, 2022 •
edited
Loading

Any thoughts on making codeQL just a daily run, and create an issue if it finds something?

I'm ok with it running on PRs, esp since scorecard checks for it.

That can be changed in scorecard too, if we learn it is acceptable. There are other projects (systemd) maintainers who complain about the unfeasibility to run SAST on large code base. We're not large code base, but SAST on memory-safe languages seem to find very little in practice.

@asraa asraa merged commit 1da39d7 into slsa-framework:main Jan 11, 2023
ramonpetgrave64 pushed a commit to ramonpetgrave64/slsa-verifier that referenced this pull request Apr 18, 2024
@ianlewis @laurentsimon
Create a release as part of generic workflow (slsa-framework#413)
2541976 
* Add ability to upload to a release

* add release id output

Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@laurentsimon laurentsimon laurentsimon approved these changes

@asraa asraa Awaiting requested review from asraa

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@ianlewis @laurentsimon @asraa