Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable code scanning on security purposes: #1313

Open
monilpat opened this issue Dec 21, 2024 · 0 comments
Open

Enable code scanning on security purposes: #1313

monilpat opened this issue Dec 21, 2024 · 0 comments
Assignees
Labels
enhancement New feature or request

Comments

@monilpat
Copy link
Collaborator

Is your feature request related to a problem? Please describe.
Our current repository lacks a robust security scanning tool integrated into our CI/CD pipeline. This leads to potential vulnerabilities being overlooked until later stages of development or after deployment, increasing the risk of security breaches and technical debt. A streamlined solution for continuous code scanning and vulnerability detection is needed.

Describe the solution you'd like
Integrate CodeQL Analysis into the GitHub repository for automated security scanning. CodeQL should:

  1. Analyze code for vulnerabilities across supported languages (C, C++, Python, JavaScript, etc.).
  2. Run scans automatically on new commits and pull requests.
  3. Generate detailed reports highlighting security risks and offering actionable remediation steps.
  4. Integrate results directly into GitHub's Security tab for easy visibility and tracking.

This integration will ensure continuous monitoring and improve overall code security and quality.

Describe alternatives you've considered

  1. Manual Code Reviews: Time-intensive and prone to human error, making it an unreliable substitute for automated tools.
  2. Third-party Tools (e.g., SonarQube, Snyk): These provide similar features but may involve additional configuration, costs, or lack the seamless integration with GitHub that CodeQL offers.
  3. Custom Scripts: Writing custom scripts for static code analysis, which is resource-intensive and lacks the depth and support of CodeQL.

Additional context

Please prioritize this integration to enhance the security and reliability of our codebase.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant