👮CodeQL Local Setup
Setting CodeQL setup locally
CodeQL scans our handshake repo. for security checks, it runs periodically (weekly) on our master branch, and for every PR raised or pushed for master and build
Currently, I have not added automation scripts to fasten our local setup, so it would involve some time-consuming manual tasks.
Why you might need a local setup?
You will need this for fixing the security bugs highlighted by CodeQL.
Steps for Js/Ts codebase
Download CodeQL CLI from the CodeQL Release Page
when done. you can follow the rest of the steps from docs.
I downloaded the package, extracted it into a folder, and then used codeql.exe this was my command,
"Downloads\codeql\codeql.exe" create js-ts-db --language=javascript-typescript
Before you run queries, make sure to delete static builds of the storybook or dashboard, else you might have to wait for a long time.
you can change the path of the CodeQL executable.
If needed you can explore this Queries list.
Analyze Repo. -
"codeql\codeql.exe" database analyze js-ts-db --format=sarif-latest -o test.sarifInstall Extension to support viewing `.sarif` log files
Once done, you can run the queries and test the bug side-by-side
Reference:
Last updated