Comments (3)
Hi @NickLiffen. I didn't have assigning privileges, but thought I'd tag you in the comments.
Regarding the questions in the readme:
- Windows, Linux, Codespaces or Mac
Mac (VS Code) - What version of NodeJS you are running.
node v16.17.0 - Add any logs that appeared when you ran into the issue.
There is a lot of console writelines about PRs being created and on what branches, but nothing stands out as an error. How do I get the logs to Error or warning/error?
from ghas-enablement.
Hey @benhorgen 👋
Firstly, it was LOVELY to see you last week at universe 〽️ 🥳
Secondly, sorry for the late reply here; this week has been focused on getting caught up with life and making sure everything is running as normal 👍 I hope you don't mind this slightly delayed response.
Okay, so you are correct in that behaviour, and that's actually by default as well.
We don't read the branches: [*, *]
array within your workflow file. We will only raise a pull request into the default branch irrelevant of what you put in that array of strings. Why do we do this? Well, it's actually for a few reasons. Firstly, for security overview, or anything else within GitHub, to think that code scanning is "turned on", it needs an analysis upload only into the default branch. So for GitHub to look at this repo and think, "is this turned on?" it only needs an analysis uploaded to the default branch, nothing else. Secondly, human error. :D This one is where the user enters the name of a branch, that isn't a branch. Maybe they mis-spelt something? Or maybe they don't really know what goes in the branches: [*, *]
array.
If you would like to do what you are talking about, my advice is to do a git pull
and then a git merge
where you merge the changes from the default branch into whatever sub-branches you have 👍 Hopefully that makes sense and somewhat explains why it works in this way 👍
from ghas-enablement.
Thanks for the insights @NickLiffen, sorry I didn't close the issue after reading your response. I was hoping to try it out before replying by then got delayed.
Your insights make sense, but based on your response, I'm curious if using the branches
value is necessary or if it can be ignored then? Or should I specify a few branches, like our test
and our main
branches? Based on your response above I get the feeling code scanning occurs on every branch (and PR) once the codeql-analysis.yml
file is committed to the default branch (and the code scanning flag is toggled in the GitHub settings menu for that repo).
from ghas-enablement.
Related Issues (20)
- Enable security on organization (python) fails HOT 3
- Enable security on organization (csharp) does not work HOT 4
- Code breaker
- 'ghas:error TypeError' on 'yarn run getRepos' HOT 3
- 'yarn run getRepos' fails with a type error HOT 1
- Enable Dependabot version updates HOT 1
- Option to enable Secret Scanning Push Protection HOT 5
- build error HOT 4
- yarn run build fails on initial clone HOT 2
- Support public repositories with `secretscanning`, or `pushprotection` HOT 4
- GitHub App token times out after 1 hour HOT 3
- User Feedback
- deleted HOT 3
- Just a minor typo HOT 1
- HTTP error when using in github Actions mode HOT 6
- Missing codeql-analysis.yaml file in root of repo HOT 1
- How to apply the CodeQL to a repo without a Pull Request? HOT 2
- How do I call `getRepos` and query for just repositories with a prefix HOT 2
- Error: git add .github/workflows/codeql-analysis.yml HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ghas-enablement.