You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: troubleshooting/codeql-builds/compiled-languages-csharp.md
+11-8Lines changed: 11 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -202,8 +202,6 @@ Recommendations:
202
202
203
203
Start here: [CodeQL Docs - The build takes too long](https://docs.github.com/en/enterprise-cloud@latest/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/troubleshooting-the-codeql-workflow#the-build-takes-too-long).
204
204
205
-
## Optimization - Caching Dependencies
206
-
Depending on the number of dependencies, it may be faster to restore packages for your project using the Actions dependency cache. Projects with many large dependencies should see a performance increase as it cuts down the time required for downloading. Projects with fewer dependencies may not see a significant performance increase and may even see a slight decrease due to how NuGet installs cached dependencies. The performance varies from project to project. See [this article](https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-net#caching-dependencies) for configuring the NuGet dependency cache.
207
205
208
206
## Optimization - Removing Code From Scans
209
207
CodeQL will extract and analyze any code that is passed through the compiler. Consider excluding any code you do not wish to include in a security scan to speed up and remove noise from this process. This is commonly employed for unit tests, demo code, or code that would not benefit from being scanned (ex: DacPacs).
@@ -217,9 +215,16 @@ With .NET we can employ a few mechanisms to remove code from CodeQL scans (e.g.
217
215
- [CodeQL yaml passes in a flag to build script](https://github.com/DuendeSoftware/IdentityServer/blob/44d8d5964edfae20c4be424c0b3a2ed5050c6fe9/.github/workflows/codeql-analysis.yml#L57) to use the CodeQL solution
218
216
- Build in release mode - exclude test projects from that [build configuration](https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2015/ide/how-to-create-and-edit-configurations?view=vs-2015&redirectedfrom=MSDN#to-modify-a-solution-wide-build-configuration)
219
217
218
+
## Optimizations - CodeQL Engine
219
+
- CodeQL will (by default) pull in source code from your dependencies using CIL extraction to assist in mapping out your data flows. While this can improve the precision of the results, this can also lead to a large increase in database size. You might consider disabling this feature for a quick scan but running a cron based scan with the option enabled.
220
+
```yml
221
+
env:
222
+
CODEQL_EXTRACTOR_CSHARP_OPTION_CIL: false
223
+
```
224
+
220
225
## Optimizations - CodeQL Queries
221
226
- Tweak your current codeql yml workflow in a few ways:
222
-
- remove security-extended queries, the default query pack with smaller set of queries will complete faster
227
+
- remove security-extended queries, the default query pack `code-scanning` has a smaller set of optimized queries and will complete faster
223
228
- As of [v2.10.5](https://github.com/github/codeql-action/releases/tag/codeql-bundle-20220908) - Query Suite Counts
224
229
- code-scanning (default) - 49 queries
225
230
- security-extended - 66 queries
@@ -235,12 +240,10 @@ With .NET we can employ a few mechanisms to remove code from CodeQL scans (e.g.
- CodeQL will (by default) pull in source code from your dependencies using CIL extraction to assist in mapping out your data flows. While this can drastically improve the precision of the results, this can also lead to a large increase in database size. You might consider disabling this feature for a quick scan but running a cron based scan with the option enabled.
239
-
```yml
240
-
env:
241
-
CODEQL_EXTRACTOR_CSHARP_OPTION_CIL: false
242
-
```
243
243
244
+
## Optimization - Caching Dependencies with GitHub Actions
245
+
246
+
Depending on the number of dependencies, it may be faster to restore packages for your project using the Actions dependency cache. Projects with many large dependencies should see a performance increase as it cuts down the time required for downloading. Projects with fewer dependencies may not see a significant performance increase and may even see a slight decrease due to how NuGet installs cached dependencies. The performance varies from project to project. See [this article](https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-net#caching-dependencies) for configuring the NuGet dependency cache.
244
247
245
248
## Vertical Scaling - Throw hardware at the software problem.
0 commit comments