Hallo, Entdecker! An dieser Seite wird aktiv gearbeitet, oder sie wird noch übersetzt. Die neuesten und genauesten Informationen findest Du in unserer englischsprachigen Dokumentation.
GitHub AE is currently under limited release. Please contact our Sales Team to find out more.

Running CodeQL code scanning in a container

You can run code scanning in a container by ensuring that all processes run in the same container.

Code scanning is available as part of GitHub Advanced Security, which is free during the beta release. Weitere Informationen findest Du unter „Informationen zu GitHub Advanced Security“.

Hinweis: Code scanning befindet sich derzeit in der Beta-Version und kann sich jederzeit verändern.

About code scanning with a containerized build

If you're setting up code scanning for a compiled language, and you're building the code in a containerized environment, the analysis may fail with the error message "No source code was seen during the build." This indicates that CodeQL was unable to monitor your code as it was compiled.

You must run CodeQL inside the container in which you build your code. This applies whether you are using the CodeQL runner or GitHub Actions. For the CodeQL runner, see "Running CodeQL runner in your CI system" for more information. If you're using GitHub Actions, configure your workflow to run all the actions in the same container. For more information, see "Example workflow."

Dependencies

You may have difficulty running code scanning if the container you're using is missing certain dependencies (for example, Git must be installed and added to the PATH variable). If you encounter dependency issues, review the list of software typically included on GitHub's virtual environments. For more information, see the version-specific readme files in these locations:

Example workflow

This sample workflow uses GitHub Actions to run CodeQL analysis in a containerized environment. The value of container.image identifies the container to use. In this example the image is named codeql-container, with a tag of f0f91db. Weitere Informationen findest Du unter „Workflow-Syntax für GitHub Actions“.

name: "CodeQL"

on: 
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '15 5 * * 3'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        language: [java]

    # Specify the container in which actions will run
    container:
      image: codeql-container:f0f91db

    steps:
      - name: Checkout repository
        uses: actions/checkout@v2
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v1
        with:
          languages: ${{ matrix.language }}
      - name: Build
        run: |
          ./configure
          make
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v1

Did this doc help you? Privacy policy

Help us make these docs great!

All GitHub docs are open source. See something that's wrong or unclear? Submit a pull request.

Make a contribution

Oder, learn how to contribute.