Running CodeQL code scanning in a container

About code scanning with a containerized build

If you're configuring code scanning for a compiled language, and you're building the code in a containerized environment, the analysis may fail with the error message "No source code was seen during the build." This indicates that CodeQL was unable to monitor your code as it was compiled.

You must run CodeQL inside the container in which you build your code. This applies whether you are using the CodeQL CLI or GitHub Actions. For the CodeQL CLI, see Using code scanning with your existing CI system for more information. If you're using GitHub Actions, configure your workflow to run all the actions in the same container. For more information, see Example workflow.

참고

CodeQL CLI는 (musl 기반) Alpine Linux와 같은 비 glibc Linux 배포판과 현재 호환되지 않습니다.

Dependencies for CodeQL code scanning

You may have difficulty running code scanning if the container you're using is missing certain dependencies (for example, Git must be installed and added to the PATH variable). If you encounter dependency issues, review the list of software typically included on GitHub's runner images. For more information, see the version-specific readme files in these locations:

Example workflow

참고

이 문서에서는 이 CodeQL 버전의 초기 릴리스에 포함된 CodeQL CLI 작업과 관련 GitHub Enterprise Server 번들의 버전에서 사용할 수 있는 기능을 설명합니다. 엔터프라이즈에서 더 최신 버전의 CodeQL 작업을 사용하는 경우, 최신 기능에 대한 자세한 내용은 이 문서의GitHub Enterprise Cloud 버전을 참조하세요. 최신 버전 사용에 대한 자세한 내용은 어플라이언스에 대한 코드 검사 구성을(를) 참조하세요.

This sample workflow uses GitHub Actions to run CodeQL analysis in a containerized environment. The value of container.image identifies the container to use. In this example the image is named codeql-container, with a tag of f0f91db. For more information, see GitHub Actions에 대한 워크플로 구문.

name: "CodeQL"

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '15 5 * * 3'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read

    strategy:
      fail-fast: false
      matrix:
        language: [java-kotlin]

    # Specify the container in which actions will run
    container:
      image: codeql-container:f0f91db

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
      - name: Build
        run: |
          ./configure
          make
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4

누가 이 기능을 사용할 수 있나요?

이 기사에서

About code scanning with a containerized build

Dependencies for CodeQL code scanning

Example workflow