Meta: Enable CodeQL static analysis for Serenity

CodeQL is a static analysis technology that was purchased by GitHub
and has been tightly integrated into the platform. It's different
from most other static analysis solutions because it's based on a
database built from your codebase, and then language specific rules
can be executed against that database. The rules are fully user
extensible, and are written in a datalog/query language.

The default cpp language rules coming from CodeQL will probably find
some issues, the ability to easily write custom rules/queries will
lend it self nicely to allowing us to validate Serenity specific
semantics are followed throughout the code.

References:
- https://www.youtube.com/watch?v=AMzGorD28Ks
- https://securitylab.github.com/tools/codeql
This commit is contained in:
Brian Gianforcaro
2020-11-26 00:16:50 -08:00
committed by Andreas Kling
parent 922d0759b0
commit f0bf723424
2 changed files with 19 additions and 0 deletions

8
.github/codeql/config.yml vendored Normal file
View File

@@ -0,0 +1,8 @@
name: "SerenityOS CodeQL Config"
queries:
- uses: security-and-quality
- uses: security-extended
# Documentation for configuring CodeQL is located here:
# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning