GitHub Community
Gradual deprecation of LGTM.com #29534
Replies: 20 comments 41 replies
-
|
good afternoon. Thanks. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @ihsinme! We're indeed actively working on features that will replace the query console (and more). We're currently testing these features with a group of beta testers. Are you a member of the GitHub Security Lab Slack channels, and if so: what's your handle there? We might be able to enrol you into the beta. |
Beta Was this translation helpful? Give feedback.
-
|
thanks for the answer. |
Beta Was this translation helpful? Give feedback.
-
|
Fantastic. We'll be in touch on Slack, likely next week! And of course you can continue to use LGTM in the meantime 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
thanks, I'll wait. |
Beta Was this translation helpful? Give feedback.
-
|
Will there be any way of downloading the CodeQL databases of various projects to query offline (like it is today on LGTM)? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, indeed there will be! That feature is being tested at the moment and will be announced soon. Are you already enrolled in the beta testing programme for the query console replacement? If not: are you a member of the GitHub Security Lab Slack channels, and if so: what's your handle there? We might be able to enrol you into the beta. |
Beta Was this translation helpful? Give feedback.
-
|
Oh, nice, I was a bit afraid it would no longer be possible! I'm not enrolled but interested, should I request an invite to the GitHub Security Lab Slack via mail then? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, that'd be great. And once you've been given access, please ping me here and we'll take it from there! |
Beta Was this translation helpful? Give feedback.
-
|
Yes now I'm on the Github Security Lab Slack, my handle is |
Beta Was this translation helpful? Give feedback.
-
|
Fantastic. We'll be in touch on Slack, likely next week! And of course you can continue to use LGTM in the meantime 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
If I'm using LGTM with GitLab and BitBucket, what could I do to continue code analysis after LGTM shuts down? |
Beta Was this translation helpful? Give feedback.
-
|
Depending on exactly what you use LGTM for, there are two options:
Hope that makes sense! |
Beta Was this translation helpful? Give feedback.
-
|
Would the updated source code of LGTM.io be pushed for archival purposes at lgtmco/lgtm? I'm sure that many people (myself included) would love to pour over old code. If not, that's fine (although a little disappointing, tbh). |
Beta Was this translation helpful? Give feedback.
-
|
LGTM.com and |
Beta Was this translation helpful? Give feedback.
-
|
Shame. If you would be so kind, please, please, please try to push for that. Often times when websites get shut down, their source code become lost to time. I really hope that the same won't happen to LGTM.com. Thanks anyways! |
Beta Was this translation helpful? Give feedback.
-
|
Hey, I work as an AppSec Engineer and have been actively using LGTM for a research piece I'm doing with CodeQL, is there anyone I can contact to plead my case for beta access 😅? |
Beta Was this translation helpful? Give feedback.
-
|
Great; leave a comment here when you have access to the Slack channels (shouldn't take long) and we'll take it from there! |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, I have access now, email is goatsniffing@gmail.com |
Beta Was this translation helpful? Give feedback.
-
|
Hey, I think this is a natural move, but will you be introducing any new functionality to GitHub to make it possible to easily list which projects have CodeQL databases built to bring it up to par with LGTM in this regard? One of the major reasons I used LGTM.com is because the UI makes it possible to exhaustively navigate projects which have public databases, whereas on GitHub unless I'm missing some major UX you have to navigate to each project and check if it does or not (and usually the answer is it does not) one by one, as opposed to just navigate a big list of projects which we know have databases (cutting down a lot of work when e.g. picking a security research project). |
Beta Was this translation helpful? Give feedback.
-
|
We're working on features in this area. Are you a member of the GitHub Security Lab Slack channels? If not: do join! From there we'll be able to add you to the beta testing programme for features like this. |
Beta Was this translation helpful? Give feedback.
-
|
It looks like the Query Console is not working at the moment. Even for the simplest queries (such as
Is this related to the deprecation and is it a known issue? |
Beta Was this translation helpful? Give feedback.
-
|
There was a temporary outage — everything is working again as it should. This was unrelated to the gradual deprecation. |
Beta Was this translation helpful? Give feedback.
-
|
Hey @sj, I introduced CodeQL for our repository yesterday (rathena/rathena#7208). Basically I totally understand the motive and reasoning for this move and support it. And great work so far! The only thing I am disappointed about is that CodeQL gives us only 6 alerts (the severity levels are questionable in my eyes) whereas LGTM gave us 69 alerts. So 10x more alerts. Do we need to configure additional queries or what is the reason why we miss so many alerts that were found on LGTM? Also will the severity levels be harmonized to the scores they had on LGTM? It feels like the severities on LGTM where much more accurate than they are now on CodeQL. Thanks in advance for your help! |
Beta Was this translation helpful? Give feedback.
-
|
As to your first question: code scanning focusses 🎯 on security and therefore by default only shows you alerts that are related to security. LGTM, on the other hand, also flags up code quality results — most people care less about those. However, if you want to see more alerts, you could consider enabling the About your second question regarding alert severities: these are now based on historical CVE/CWE data 📈. You can find more information about that in this announcement here. Hope that helps! |
Beta Was this translation helpful? Give feedback.
-
|
Helped a lot! Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
If possible I would like to beta-test the Query Console replacement, though I did not use the Query Console that actively during the past weeks. Therefore if there is a limit on the number of beta testers, I won't mind if I can't become one. My user name on the GitHub Security Slack channel is Marcono1234 (same as on GitHub). |
Beta Was this translation helpful? Give feedback.
-
|
Hi @Marcono1234 |
Beta Was this translation helpful? Give feedback.
-
|
I also want to join, My user name on the GitHub Security Slack channel is SummerSec (same as on GitHub). @jf205 |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @SummerSec. Let's discuss further on Slack. |
Beta Was this translation helpful? Give feedback.
-
|
Is it possible to use CodeQL action workflow without uploading security alerts (i.e. as a Pull Request check only)? |
Beta Was this translation helpful? Give feedback.
-
|
That sounds like a topic that's unrelated to the gradual deprecation of LGTM.com. Would you mind opening a separate new Discussion so we can dive deeper into exactly what you mean and are trying to achieve? Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Hi sj, I am a security researcher at Indiana University, and I was wondering if you could please help with accessing reports that already exist on LGTM - would the API be the best way? I am unable to sign up as a new user. Finally, I also joined the slack.. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @agrimsachdeva. Let's talk about this on Slack! |
Beta Was this translation helpful? Give feedback.
-
|
Hi! I am an author of several projects which use LGTM(e.g. https://github.com/brainflow-dev/brainflow) According to https://github.blog/2022-08-15-the-next-step-for-lgtm-com-github-code-scanning/ we should get some automated PRs for migration but its already the end of October and there is nothing. So, should we do it by ourselves or wait a little more? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @Andrey1994 Hopefully the automated PRs will land before the end of October, which is still a week away 😄 . Thanks for your patience while we work on this. |
Beta Was this translation helpful? Give feedback.
-
|
It looks like for that project code scanning with CodeQL is already set up though: https://github.com/brainflow-dev/brainflow/blob/master/.github/workflows/codeql_analysis.yml |
Beta Was this translation helpful? Give feedback.
-
|
Hello, We use LGTM and recently got the PR for switching to GH code scanning - sosreport/sos#3064. The initial change was functional, but we noticed that it was highlighting a large amount of alerts from our test suite, which we don't want scanned. Looking at the docs it seems like this should easily be remedied by adding a I did that, committing directly to lgtm's fork via the GH webUI, but the action is now failing saying that So, if it's not the documented |
Beta Was this translation helpful? Give feedback.
-
|
The way you are adding In order to actually avoid the scanning of specific paths by CodeQL itself, you may use a CodeQL configuration file - a file located in your repository, provided to the |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @jorgectf - that seems to be working for us. |
Beta Was this translation helpful? Give feedback.
-
|
Hi! This is kind of a silly question - are there plans for supporting the former LGTM badges that could be added to repo readmes that showed a code quality score? Even if a secondary feature, it was definitely nice to have a badge showing a clean score on my public repos. :) |
Beta Was this translation helpful? Give feedback.
-
|
Hi @DLesage25 |
Beta Was this translation helpful? Give feedback.
-
|
@AlonaHlobina I don't really understand why the original blog post brags about offering more than what LGTM offered, when obviously, we'll be loosing our code quality scoring and badges -- which means that the current offering isn't the boasted superset of current functionalities. Don't get me wrong: I'm grateful for all the stuff that I'm getting now, but I think the original blog post could have been much more transparent (honest) about the actual state of affairs. Anyway, please consider code quality indication an important feature: while at the top of this thread it says "people care less", I think it's more like "many people don't care" but also "some people care a lot". So, like the original poster, I'd like beg you to please consider adding code quality back in! |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much, @DLesage25 and @ehuelsmann, for your feedback. We will seriously consider badges for the near future. |
Beta Was this translation helpful? Give feedback.
-
|
Isn't it kind of obvious GitHub is all about badges ;) |
Beta Was this translation helpful? Give feedback.
-
|
Hi! One of my repository (https://github.com/roastduck/FreeTensor) uses LGTM, and I should have gotten an automated PR for migration, but there is not. I see there was some delay mentioned in another post in this discussion, but now it is the end of November, and there is only less than two weeks before the planned disabling. Should I wait more or set up it by ourselves? Thanks in advance. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @roastduck! We've so far filed over 6000 automatically-generated pull requests, and over 200 manually-crafted PRs. I had a quick look as to why your repository hasn't received a PR, and that's actually to do with your specific Next week we'll start opening PRs for the relatively small number of repositories that we couldn't automatically create workflow files for. Those PRs will contain workflow configurations that unfortunately don't work yet and therefore need extra attention 👀 from developers. If you don't mind taking a closer look yourself, then it's probably best if you try creating a CodeQL workflow file manually. No need to wait for us! And I'm sorry we weren't able to auto-generate it for you. |
Beta Was this translation helpful? Give feedback.
-
|
I have been using the LGTM interface in a software engineering unit, that covered static analysis. The nice thing was that student could simply write their own checks and run them on GitHub repos. Is there any way to do it as easily with codeQL as with LGTM? Sure, the language is the same, but I wonder about the interface. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @afehnker We're working on features that will replace LGTM's query writing features. There's actually a beta test currently happening that you might be interested in. If you haven't already, I'd recommend joining the GitHub Security Lab Slack channels. One you're in we can talk about adding you to the beta test 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Hi, was wondering if we could get an automated migration PR for https://github.com/arkime/arkime thanks!! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @awick I haven't taken a look at your repo in much detail, so I'm not if we are able to automatically generate a migration PR for you. In the meantime, please could you try following the docs to set it up yourself? If you need any extra assistance please follow up and we'll see what we can do. Thanks! 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I am trying to exclude some directories from scanning. I wrote a custom configuration file containing a However, I am analyzing for C++. Can I configure this exclusion for a C++ analysis? If not, can I hide the alerts for some directories (just like Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @roastduck, Thank you for the question. You can now exclude the files in specific directories from analysis by adding a The code scanning team will work on adding support for this functionality for all CodeQL-supported languages in the nearest future. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your reply. I am really looking forward to the As for ignoring the directories in the build phase, however, I don't think it works for my case. In my case, the repo can only be built with all source directories including the third-party directories (which are to be ignored). Therefore, I cannot ignore those directories in the building phase. This is different from ignoring a "test" directory, which can be ignored from build. Instead, I hope I can only ignore them from analysis, or ignore their analysis results. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I'm building/reviewing the automatic PR created for my C++ project by query-filters:
- exclude:
id: extthis "ext" directory contains third party libraries/code that should not be included as part of LGTM scanning, except it doesn't seem to exclude these directories from scanning |
Beta Was this translation helpful? Give feedback.
-
|
The PR was automatically generated from your existing The specified exclusion in the There's another thread just above that discusses |
Beta Was this translation helpful? Give feedback.
-
|
@sj Thanks, I had seen the comments about Any ETA on this? It makes things somewhat difficult for any C++ application with less than ideal third party libraries. |
Beta Was this translation helpful? Give feedback.
-
|
Hey @sj |
Beta Was this translation helpful? Give feedback.
-
|
Can you please remove all MITRE GitHub org projects from lgtm.com. github.com/mitre/heimdall2 Thank you and let us know if we need to take any actions |
Beta Was this translation helpful? Give feedback.
-
|
Hello, my account is |
Beta Was this translation helpful? Give feedback.
-
|
Hi @AirSkye Our new feature for running CodeQL queries at scale is now publicly available: Multi-repository variant analysis Please take a look 🙂 |
Beta Was this translation helpful? Give feedback.
and others
-
On the 15th of August, we announced the gradual deprecation of LGTM.com on the GitHub blog 📝. For more information, please take a look at that post — it contains key dates and information about migrating to GitHub code scanning.
If you have any questions or comments, feel free to discuss this news below. We'll do our best to answer any questions you might have!
Beta Was this translation helpful? Give feedback.
All reactions