Hacker News Reader

Comment by CalmStorm | Hacker News Reader

What programming languages does it support? I couldn’t find out from the press release.

I had to click around a bit from the PR but:

CodeQL code scanning automatically detects code written in the supported languages

   C/C++
   C#
   Go
   Java
   JavaScript/TypeScript
   Python

Source: https://docs.github.com/en/free-pro-team@latest/github/findi...

That's a pretty good start! I'm happy to see security checking be democratized.

Interesting. Consider that Github uses lots of Ruby but the tool does not support Ruby from the get go.

I have been noticing that a lot as well on other places. Ruby is no longer a "Default supported" language in many new projects.

OpenTelemtry for example doesn't include Ruby in its initial beta program announcement.

".NET, Java, JavaScript, Python, Go, and Erlang!"

>Ruby is no longer a "Default supported" language in many projects.

Well it has always been like that. Amazon and Google has always had a thing about Ruby, and it is a minority market so I am not surprised and it doesn't make sense from Business perspective. But Github is a heavy Ruby users so I would have thought Ruby would be a first class citizen. I wonder if it has something to do with the language complexity.

Edit: From Github.

https://news.ycombinator.com/item?id=23094160

We (GitHub) absolutely plan to expand the list of languages CodeQL supports, and Ruby is a language we'd love to add (we're heavy users of it internally). In the meantime, because code scanning is extensible you can plug in third party analysis engines to scan the languages that CodeQL doesn't support.

CodeQL is based on an existing product from a company called Semmle which GitHub acquired in late 2019 [1]

They have been part of GitHub for barely a year so it's not too surprising, especially given they are continuing to support the product for the enterprise customers they had previously not just GitHub.

[1] https://techcrunch.com/2019/09/18/github-acquires-code-analy...

PM from GitHub here.

We're adding Ruby support to CodeQL (the scanning engine used in code scanning by default). It's our top requested language, and one we use extensively internally. Adding each new language to CodeQL takes about 6-9 months and needs a team to maintain it in perpetuity, which is why we don't have it yet, but we're starting that work now.

The other languages we hear the most demand for CodeQL support on are PHP, Kotlin and Swift. We'll get to all of those - it will just take a little time.

In the meantime, all of the code scanning experiences are extensible, so you can use other scanning engines with it, like Brakeman for Ruby.

Is the CodeQL project itself open source? I would love to contribute support for Elixir.

Is this it? https://github.com/github/codeql

Kind of surprised PHP isn't a front runner here

OK, so I won’t be using it. I write in Swift, ObjC, and PHP.

I really think that PHP should be on that list.

Code scanning itself isn't language specific. There are open source and commerical tools for many languages available. CodeQL is GitHub's first party tool, and it supports C, C++, C#, Go, Java, JavaScript, Typescript, and Python.

I'm not sure but from [1]:

> This open-source repository contains the extractor, CodeQL libraries, and queries that power Go support in LGTM and the other CodeQL products that GitHub makes available to its customers worldwide.

[1]: https://github.com/github/codeql-go#go-analysis-support-for-...

If I read correctly code scanning is based on CodeQL, and i found this https://help.semmle.com/codeql/supported-languages-and-frame...

So it looks like it supports C/C++/C#/Go/Java/JS/Python/TS

Reply on news.ycombinator.com