You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+44-20Lines changed: 44 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,26 +6,50 @@ _Configure your CodeQL workflows with a language matrix to simplify your code sc
6
6
7
7
</header>
8
8
9
-
## Welcome
10
-
11
-
In this course we will explore how you can configure CodeQL using configuration files. During this course, we will show you how to add a query pack to a CodeQL configuration file as well as configure your workflow to reference that configuration file.
12
-
13
-
-**Who is this for**: Developers, security engineers, open source maintainers.
14
-
-**What you'll learn**: We'll show you how to configure your workflow to use a language matrix. We will also cover the autobuild action for compiled langauges. This will allow you to have a single code scanning workflow that covers all the languages in your repository.
15
-
-**What you'll build**: A secure software development pipeline that has been tuned to your project's specific needs.
16
-
-**Prerequisites**: Knowledge of how the Context and expressions work in workflows. You can learn more about this in the [GitHub Actions documentation](https://docs.github.com/en/actions).
17
-
-**How long**: This course is 2 steps long and takes less than 30 minutes to complete.
1. Right-click **Start course** and open the link in a new tab.
24
-
2. In the new tab, most of the prompts will automatically fill in for you.
25
-
- For owner, choose your personal account or an organization to host the repository.
26
-
- We recommend creating a public repository, as private repositories will [use Actions minutes](https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions).
27
-
- Scroll down and click the **Create repository** button at the bottom of the form.
28
-
3. After your new repository is created, wait about 20 seconds, then refresh the page. Follow the step-by-step instructions in the new repository's README.
9
+
## Step 1: Add a language matrix to your CodeQL workflow file
10
+
11
+
_Welcome to "Configuring a CodeQL language matrix"! :wave:_
12
+
13
+
## CodeQL language matrices
14
+
15
+
CodeQL language matrices allow you to configure your CodeQL workflows with a language matrix to simplify your code scanning workflows. This allows you to have a single code scanning workflow that covers all the languages in your repository.
16
+
17
+
### Importance of using languages matrices with code scanning
18
+
19
+
1.**Simplicity**: Using a language matrix with CodeQL simplifies your workflow by allowing you to manage multiple languages in a single workflow file. This eliminates the need for separate workflows for each language, making your code scanning process more streamlined and manageable.
20
+
2.**Flexibility**: A language matrix provides flexibility as it allows you to easily add or remove languages from your workflow. This means you can quickly adapt your code scanning process to changes in your project's language usage.
21
+
3.**Consistency**: By using a language matrix, you ensure consistent code scanning across all languages used in your project. This helps maintain the quality and security of your codebase, regardless of the language it's written in.
22
+
23
+
Remember, a well-configured CodeQL setup is key to maintaining a secure and reliable codebase.
24
+
25
+
### :keyboard: Activity: Configure your `codeql.yml` file to use a language matrix
26
+
27
+
1. Navigate to the `Code` tab and locate the `.github/workflows` folder.
28
+
1. Add the following content to the `codeql.yml` file before the steps section:
# Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
36
+
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
37
+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
38
+
39
+
```
40
+
1. Ensure that your indentation is correct after adding the strategy section.
41
+
1. Now that you have added the strategy, you need to update CodeQL to actually use the language matrix. Add the following to the CodeQL init action:
42
+
```yaml
43
+
with:
44
+
languages: ${{ matrix.language }}
45
+
```
46
+
1. Finally we need to add the language matrix to the CodeQL analyze action. Add the following to the CodeQL analyze action:
47
+
```yaml
48
+
with:
49
+
category: ${{ matrix.language }}
50
+
```
51
+
1. Commit the changes directly to the `main` branch.
52
+
1. Wait about 20 seconds then refresh this page (the one you're following instructions from). [GitHub Actions](https://docs.github.com/en/actions) will automatically update to the next step.
0 commit comments