Multi-language scanners and auditors should declare the languages they read

未关闭
  • 哪里不对？
#143 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
68/100
Issue 类型
重构
描述清晰度
描述清楚
活跃度
活跃
技术栈
github, python
领域
testing, tooling

调研方向

Start by reading the shared modules that define multi_language_scanners and multi_ecosystem_audits, then inspect the profiles that currently filter tools by language name. The issue also points to tests/checks/test_security_scanning.py::test_passes_with_codeql_in_every_layout; use that test to understand the current exclusions. Done means tool language or lockfile support is declared centrally, profiles select compatible tools from that data, and the test derives CodeQL exclusions from it.

由索引模型根据 Issue 内容生成。

描述

multi_language_scanners(languages) returns CodeQL, GitLab SAST and semgrep for whatever languages a profile passes, and multi_ecosystem_audits returns osv-scanner, trivy, snyk and GitLab Dependency Scanning likewise. But the tools do not read every language: CodeQL reads none of PHP, HCL, Elixir, Erlang, Scala or Dart; osv-scanner and trivy read no sbt build; snyk reads no pubspec.lock. So each profile filters the lists by name (php, terraform, beam, scala, dart all do), and tests/checks/test_security_scanning.py::test_passes_with_codeql_in_every_layout keeps a hand-written set of the languages CodeQL does not read.

Better: the shared modules know what each tool reads (CODEQL_LANGUAGES = {"C", "C++", "Go", "Java", ...}, OSV_LOCKFILES per ecosystem), and a profile asks for multi_language_scanners(languages) and gets only the tools that read one of them. The CodeQL layout test then derives its exclusions from the same table.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

主要语言
Python
星标
4
派生
1
平均合并
10 小时 41 分钟
30 天内合并 PR
79

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

cpp-best-practices/project_validator 的其他 Issue

查看 cpp-best-practices/project_validator 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。