[Public Beta] CodeQL can scan Java projects without a build

[coadaflorin]

A key requirement for scanning Java with CodeQL was to have a working build. We are now able to scan Java projects without the need for a working build. We really ❤️ feedback and while this feature is in a public beta we welcome feedback about this new approach for scanning Java.

If you prefer sharing feedback directly, feel free to reach out at [email protected] .

Who is this available for?

• This is available now to all GitHub code scanning users via default setup.
• This is available now to all GitHub code scanning users advanced setup. Use the build-mode: none option to trigger this behaviour.
• The feature is available for the CodeQL CLI starting with version 2.16.5. Use the --build-mode none option to trigger this behaviour.

[ebickle]

Can you clarify how this works internally? Is there a new extractor that directly parses Java and Kotlin code (similar to Javascript, Typescript, and Python) or does it still try to run an autobuild and then try to analyze the instrumented results of the failed build?

I tried this out on a Java repository (no Kotlin code) that had never had CodeQL enabled and noticed it still ran the autobuild action.

[coadaflorin]

Hey @ebickle! We always directly scan the source code, but for static languages like Java we need additional information to produce accurate results.
The Autobuild step itself will still run, but if you expand that you'll notice a message that indicates we are not using a build. The step is still there, but there won't be an actual build happening. Here's an example: https://github.com/fnc-test/AltoroJ2/actions/runs/8290693802/job/22689162296#step:4:80

If you visit the Tool Status Page you will also see an indication of this happening.

[ebickle]

@coadaflorin Thanks! I see what's happening now - it's triggering Maven to download dependencies (and potentially other tasks) and getting a BUILD SUCCESS message as a result, even though it's not actually running through a compilation. Very cool!

[coadaflorin]

Let us know how things go for you!

[harringj]

Really excited about this new feature! @coadaflorin, is there any way to take advantage of the build-less scans if we pull dependencies through Artifactory rather than Maven central?

[coadaflorin]

I would love to hear more about your use-case and setup. That is something that we are currently investigating!
At the moment there's no easy way to set-up Artifactory, but there might be some short-term workarounds we can suggest. Would you mind connecting via email for a chat? My address is the [email protected].

[ManulBandara]

As of my last update in January 2022, CodeQL, a semantic code analysis engine developed by GitHub, allows for scanning Java projects without requiring a build. This capability enables developers to perform static analysis on Java codebases without having to compile the code first. By directly analyzing the source code, CodeQL can detect security vulnerabilities, bugs, and other issues in Java projects.

[coadaflorin]

In January 2022, the statement "perform static analysis on Java codebases without having to compile the code first" was not accurate for Java which did require a manual or automated build. Starting with CodeQL 2.16.5 we ca scan Java without a build.

[GranitFazliuRB]

Any estimate on when this might leave public beta, and be available also for GitHub Enterprise Server?

[coadaflorin]

We currently do not have a concrete date for a ship to GitHub Enterprise Server. We are going to ship this out to Enterprise Server too, we just need to complete our beta before doing so. We are happy to explore options for you to try this out during the beta. Would you mind connecting via email for a chat? My address is [email protected].