Hacker News Reader

The new CodeQL feature supports only C, C++, C#, Java, JavaScript, TypeScript, Python, and Go developers. While PHP is classified as the 5th most active programming language on Github, it’s not supported by the new security code scanning feature. PHP developers have lots of alternatives depending on the framework you are using, or simply using static analysis tools such as Psalm and PHPStan.

View on HN

>While PHP is classified as the 5th most active programming language on Github, it’s not supported by the new security code scanning feature.

Fyi constructive criticism... both your blog post and your HN comment do not directly answer the title's question of "Why not for PHP?"

The indirect answer seems to be: "because the CodeQL feature is based on the Semmle acquisition and that technology never analyzed PHP code -- and Microsoft/Github also didn't add PHP to this new rollout."

Also see comment from a Github employee: https://news.ycombinator.com/item?id=24648281

Reply on news.ycombinator.com