4 ms·

What programming languages does it support? I couldn’t find out from the press release.

hbcondo714 6y ago
I had to click around a bit from the PR but: CodeQL code scanning automatically detects code written in the supported languages C/C++ C# Go Java JavaScript/TypeScript Python Source: https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed https://docs.github.com/en/free-pro-team@latest/github/findi...
- sudosysgen 6y ago
  That's a pretty good start! I'm happy to see security checking be democratized.
- ksec 6y ago
  Interesting. Consider that Github uses lots of Ruby but the tool does not support Ruby from the get go.
  - rurounijones 6y ago
    I have been noticing that a lot as well on other places. Ruby is no longer a "Default supported" language in many new projects. OpenTelemtry for example doesn't include Ruby in its initial beta program announcement. ".NET, Java, JavaScript, Python, Go, and Erlang!"
    - ksec 6y ago
      >Ruby is no longer a "Default supported" language in many projects. Well it has always been like that. Amazon and Google has always had a thing about Ruby, and it is a minority market so I am not surprised and it doesn't make sense from Business perspective. But Github is a heavy Ruby users so I would have thought Ruby would be a first class citizen. I wonder if it has something to do with the language complexity. Edit: From Github. https://news.ycombinator.com/item?id=23094160 https://news.ycombinator.com/item?id=23094160 We (GitHub) absolutely plan to expand the list of languages CodeQL supports, and Ruby is a language we'd love to add (we're heavy users of it internally). In the meantime, because code scanning is extensible you can plug in third party analysis engines to scan the languages that CodeQL doesn't support.
    - deleted 6y ago
      [deleted]
  - deleted 6y ago
    [deleted]
  - innoying 6y ago
    CodeQL is based on an existing product from a company called Semmle which GitHub acquired in late 2019 [1] They have been part of GitHub for barely a year so it's not too surprising, especially given they are continuing to support the product for the enterprise customers they had previously not just GitHub. [1] https://techcrunch.com/2019/09/18/github-acquires-code-analysis-tool-semmle/ https://techcrunch.com/2019/09/18/github-acquires-code-analy...
  - greysteil 6y ago
    PM from GitHub here. We're adding Ruby support to CodeQL (the scanning engine used in code scanning by default). It's our top requested language, and one we use extensively internally. Adding each new language to CodeQL takes about 6-9 months and needs a team to maintain it in perpetuity, which is why we don't have it yet, but we're starting that work now. The other languages we hear the most demand for CodeQL support on are PHP, Kotlin and Swift. We'll get to all of those - it will just take a little time. In the meantime, all of the code scanning experiences are extensible, so you can use other scanning engines with it, like Brakeman for Ruby.
    - triplejjj 6y ago
      Is the CodeQL project itself open source? I would love to contribute support for Elixir.
      - dentarg 6y ago
        Is this it? https://github.com/github/codeql https://github.com/github/codeql
- stolen_biscuit 6y ago
  Kind of surprised PHP isn't a front runner here
- deleted 6y ago
  [deleted]
- ChrisMarshallNY 6y ago
  OK, so I won’t be using it. I write in Swift, ObjC, and PHP. I really think that PHP should be on that list.
mmusc 6y ago
If I read correctly code scanning is based on CodeQL, and i found this https://help.semmle.com/codeql/supported-languages-and-frameworks.html https://help.semmle.com/codeql/supported-languages-and-frame... So it looks like it supports C/C++/C#/Go/Java/JS/Python/TS
DelightOne 6y ago
I'm not sure but from [1]: > This open-source repository contains the extractor, CodeQL libraries, and queries that power Go support in LGTM and the other CodeQL products that GitHub makes available to its customers worldwide. [1]: https://github.com/github/codeql-go#go-analysis-support-for-codeql https://github.com/github/codeql-go#go-analysis-support-for-...
jhutchings0 6y ago
Code scanning itself isn't language specific. There are open source and commerical tools for many languages available. CodeQL is GitHub's first party tool, and it supports C, C++, C#, Go, Java, JavaScript, Typescript, and Python.

I had to click around a bit from the PR but: CodeQL code scanning automatically detects code written in the supported languages C/C++ C# Go Java JavaScript/TypeScript Python Source: https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed https://docs.github.com/en/free-pro-team@latest/github/findi...

sudosysgen 6y ago
That's a pretty good start! I'm happy to see security checking be democratized.
ksec 6y ago
Interesting. Consider that Github uses lots of Ruby but the tool does not support Ruby from the get go.
- rurounijones 6y ago
  I have been noticing that a lot as well on other places. Ruby is no longer a "Default supported" language in many new projects. OpenTelemtry for example doesn't include Ruby in its initial beta program announcement. ".NET, Java, JavaScript, Python, Go, and Erlang!"
  - ksec 6y ago
    >Ruby is no longer a "Default supported" language in many projects. Well it has always been like that. Amazon and Google has always had a thing about Ruby, and it is a minority market so I am not surprised and it doesn't make sense from Business perspective. But Github is a heavy Ruby users so I would have thought Ruby would be a first class citizen. I wonder if it has something to do with the language complexity. Edit: From Github. https://news.ycombinator.com/item?id=23094160 https://news.ycombinator.com/item?id=23094160 We (GitHub) absolutely plan to expand the list of languages CodeQL supports, and Ruby is a language we'd love to add (we're heavy users of it internally). In the meantime, because code scanning is extensible you can plug in third party analysis engines to scan the languages that CodeQL doesn't support.
  - deleted 6y ago
    [deleted]
- deleted 6y ago
  [deleted]
- innoying 6y ago
  CodeQL is based on an existing product from a company called Semmle which GitHub acquired in late 2019 [1] They have been part of GitHub for barely a year so it's not too surprising, especially given they are continuing to support the product for the enterprise customers they had previously not just GitHub. [1] https://techcrunch.com/2019/09/18/github-acquires-code-analysis-tool-semmle/ https://techcrunch.com/2019/09/18/github-acquires-code-analy...
- greysteil 6y ago
  PM from GitHub here. We're adding Ruby support to CodeQL (the scanning engine used in code scanning by default). It's our top requested language, and one we use extensively internally. Adding each new language to CodeQL takes about 6-9 months and needs a team to maintain it in perpetuity, which is why we don't have it yet, but we're starting that work now. The other languages we hear the most demand for CodeQL support on are PHP, Kotlin and Swift. We'll get to all of those - it will just take a little time. In the meantime, all of the code scanning experiences are extensible, so you can use other scanning engines with it, like Brakeman for Ruby.
  - triplejjj 6y ago
    Is the CodeQL project itself open source? I would love to contribute support for Elixir.
    - dentarg 6y ago
      Is this it? https://github.com/github/codeql https://github.com/github/codeql
stolen_biscuit 6y ago
Kind of surprised PHP isn't a front runner here
deleted 6y ago
[deleted]
ChrisMarshallNY 6y ago
OK, so I won’t be using it. I write in Swift, ObjC, and PHP. I really think that PHP should be on that list.

mmusc 6y ago

If I read correctly code scanning is based on CodeQL, and i found this https://help.semmle.com/codeql/supported-languages-and-frameworks.html https://help.semmle.com/codeql/supported-languages-and-frame... So it looks like it supports C/C++/C#/Go/Java/JS/Python/TS

DelightOne 6y ago

I'm not sure but from [1]: > This open-source repository contains the extractor, CodeQL libraries, and queries that power Go support in LGTM and the other CodeQL products that GitHub makes available to its customers worldwide. [1]: https://github.com/github/codeql-go#go-analysis-support-for-codeql https://github.com/github/codeql-go#go-analysis-support-for-...

jhutchings0 6y ago

Code scanning itself isn't language specific. There are open source and commerical tools for many languages available. CodeQL is GitHub's first party tool, and it supports C, C++, C#, Go, Java, JavaScript, Typescript, and Python.