Skip to content

Commit 6466f17

Browse files
authored
Update compiled-languages-csharp.md
1 parent 10819d1 commit 6466f17

File tree

1 file changed

+11
-8
lines changed

1 file changed

+11
-8
lines changed

troubleshooting/codeql-builds/compiled-languages-csharp.md

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -202,8 +202,6 @@ Recommendations:
202202

203203
Start here: [CodeQL Docs - The build takes too long](https://docs.github.com/en/enterprise-cloud@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow#the-build-takes-too-long).
204204

205-
## Optimization - Caching Dependencies
206-
Depending on the number of dependencies, it may be faster to restore packages for your project using the Actions dependency cache. Projects with many large dependencies should see a performance increase as it cuts down the time required for downloading. Projects with fewer dependencies may not see a significant performance increase and may even see a slight decrease due to how NuGet installs cached dependencies. The performance varies from project to project. See [this article](https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-net#caching-dependencies) for configuring the NuGet dependency cache.
207205

208206
## Optimization - Removing Code From Scans
209207
CodeQL will extract and analyze any code that is passed through the compiler. Consider excluding any code you do not wish to include in a security scan to speed up and remove noise from this process. This is commonly employed for unit tests, demo code, or code that would not benefit from being scanned (ex: DacPacs).
@@ -217,9 +215,16 @@ With .NET we can employ a few mechanisms to remove code from CodeQL scans (e.g.
217215
- [CodeQL yaml passes in a flag to build script](https://github.com/DuendeSoftware/IdentityServer/blob/44d8d5964edfae20c4be424c0b3a2ed5050c6fe9/.github/workflows/codeql-analysis.yml#L57) to use the CodeQL solution
218216
- Build in release mode - exclude test projects from that [build configuration](https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2015/ide/how-to-create-and-edit-configurations?view=vs-2015&redirectedfrom=MSDN#to-modify-a-solution-wide-build-configuration)
219217

218+
## Optimizations - CodeQL Engine
219+
- CodeQL will (by default) pull in source code from your dependencies using CIL extraction to assist in mapping out your data flows. While this can improve the precision of the results, this can also lead to a large increase in database size. You might consider disabling this feature for a quick scan but running a cron based scan with the option enabled.
220+
```yml
221+
env:
222+
CODEQL_EXTRACTOR_CSHARP_OPTION_CIL: false
223+
```
224+
220225
## Optimizations - CodeQL Queries
221226
- Tweak your current codeql yml workflow in a few ways:
222-
- remove security-extended queries, the default query pack with smaller set of queries will complete faster
227+
- remove security-extended queries, the default query pack `code-scanning` has a smaller set of optimized queries and will complete faster
223228
- As of [v2.10.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-20220908) - Query Suite Counts
224229
- code-scanning (default) - 49 queries
225230
- security-extended - 66 queries
@@ -235,12 +240,10 @@ With .NET we can employ a few mechanisms to remove code from CodeQL scans (e.g.
235240
CODEQL_ACTION_EXTRA_OPTIONS: '{"database": {"run-queries": ["--off-heap-ram=0"]}}'
236241
```
237242

238-
- CodeQL will (by default) pull in source code from your dependencies using CIL extraction to assist in mapping out your data flows. While this can drastically improve the precision of the results, this can also lead to a large increase in database size. You might consider disabling this feature for a quick scan but running a cron based scan with the option enabled.
239-
```yml
240-
env:
241-
CODEQL_EXTRACTOR_CSHARP_OPTION_CIL: false
242-
```
243243

244+
## Optimization - Caching Dependencies with GitHub Actions
245+
246+
Depending on the number of dependencies, it may be faster to restore packages for your project using the Actions dependency cache. Projects with many large dependencies should see a performance increase as it cuts down the time required for downloading. Projects with fewer dependencies may not see a significant performance increase and may even see a slight decrease due to how NuGet installs cached dependencies. The performance varies from project to project. See [this article](https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-net#caching-dependencies) for configuring the NuGet dependency cache.
244247

245248
## Vertical Scaling - Throw hardware at the software problem.
246249

0 commit comments

Comments
 (0)