salut la commu

salu la comu

Thanks for the info. Investigating this without knowing which repo it is is difficult. If you're not happy to share the repo name here so we can investigate further, then you've got a couple of options: You could either try to reproduce in a repo you are willing to share or have the repo owner open a support ticket which will keep information confidential between them and us. Up to you which to do next. Thanks

Maybe let's do it in other way. Could you share some example repository link where there are custom queries introduced and when new vulnerability is introduced in PR it shows alert as expected?

Based on that I will compare existing solution and adjust if needed, maybe there are some missing parameters/values in my setup

I'm having a look to see if we know of an example repository of that sort. In the mean time, a couple of questions.

You gave me this extract from your YAML file:

queries: +./.github/codeql/codeql-custom-queries-go # Include custom queries

1. Just to confirm - this is from your Actions workflow file, not a custom configuration file, right?
2. Are you using a custom configuration file as well? The + syntax is for combining query configuration in the workflow with that in the custom config file, hence asking.
3. The line above doesn't include the default queries. If they're not included in a custom configuration file then you might want to include them here to ensure that they run. That would look like this (adding default,):

queries: +default,./.github/codeql/codeql-custom-queries-go # Include custom queries

Hi,

1. Yes
2. I have only one yml file with the workflow
3. Default scope of tests is running, I see it in logs

Could you share some example repository link where there are custom queries introduced and when new vulnerability is introduced in PR it shows alert as expected

This ask is quite specific and so we didn't have an example to hand, I'm afraid.

I'm going to repeat what I said before: Investigating this without knowing which repo it is is difficult. If you're not happy to share the repo name here so we can investigate further, then you've got a couple of options: You could either try to reproduce in a repo you are willing to share or have the repo owner open a support ticket which will keep information confidential between them and us.

We're limited in how much more support we can give in this discussion without you taking one of the approaches above, so over to you which to choose. Thanks

I see scans in logs. When I will add to PR new file with vulnerability, after scan I see new vulnerability in Code Scanning tab but not in the PR. It's scanning correctly but not displaying it in the PR (for custom query result)