Create codeql.yml

[ThibaudLopez]

Enable CodeQL

[github-advanced-security]

You have successfully added a new CodeQL configuration /language:python. As part of the setup process, we have scanned this repository and found no existing alerts. In the future, you will see all code scanning alerts on the repository Security tab.

[ThibaudLopez]

@DzmitryFomchyn , do you know how to setup CodeQL for Java for this repo? It failed to auto scan.

[DzmitryFomchyn]

@DzmitryFomchyn , do you know how to setup CodeQL for Java for this repo? It failed to auto scan.

@ThibaudLopez it seems that the error is SDK Registry token is not specified. which comes from here. We need a few more tokens to build the SDK (more information).

[ThibaudLopez]

@DzmitryFomchyn , do you know how to do the setup?

[ThibaudLopez]

see mapbox/mapbox-navigation-android#7048 for example of CodeQL setup for Kotlin

[ghost]

Seems to be way outdated

[ThibaudLopez]

re-opening... we still need code scanning for this repo

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[ghost]

@ThibaudLopez It's broken in its current form. CI/CD didn't pass.

[ThibaudLopez]

@eugenes78 , correct, CodeQL is not yet setup to build the Java project of this repo as the CodeQL auto-build doesn't succeed. We need somebody that's familiar with how to build this repo to please setup the CodeQL YAML to do the same build.

[ghost]

@ThibaudLopez Are you making progress on this one? It's open for more than a year already...

[ThibaudLopez]

@eugenes78 ,

Are you making progress on this one? It's open for more than a year already...

No, we've been needing help for a year, somebody familiar with how to build this repo, then put those instructions in the CodeQL YAML. If needed, we can close this PR and leave this repo without code scanning. We can try the other code scanning (we can follow-up internally).