Skip to main content

์ผ๋ถ€ ์–ธ์–ด๋Š” CodeQL ๊ณ ๊ธ‰ ์„ค์ •์œผ๋กœ ๋ถ„์„๋˜์ง€ ์•Š์•˜์Šต๋‹ˆ๋‹ค.

์ผ๋ถ€ ์–ธ์–ด๊ฐ€ ๋ถ„์„๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ code scanning ์›Œํฌํ”Œ๋กœ๋ฅผ ์ˆ˜์ •ํ•˜์—ฌ ๋ถ„์„ํ•  ์–ธ์–ด๋ฅผ ์ง€์ •ํ•˜๋Š” ํ–‰๋ ฌ์„ ์ถ”๊ฐ€ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๊ณ ๊ธ‰ ์„ค์ •์„ ์‚ฌ์šฉ ์ค‘์ด๊ณ  ์›Œํฌํ”Œ๋กœ์—์„œ ๋ถ„์„ํ•  ์–ธ์–ด๋ฅผ ๋ช…์‹œ์ ์œผ๋กœ ์ง€์ •ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ CodeQL์€(๋Š”) ์ฝ”๋“œ ๋ฒ ์ด์Šค์—์„œ ์ง€์›๋˜๋Š” ์–ธ์–ด๋ฅผ ์•”์‹œ์ ์œผ๋กœ ๊ฒ€์ƒ‰ํ•ฉ๋‹ˆ๋‹ค. ์ด ๊ตฌ์„ฑ์˜ ์ปดํŒŒ์ผ๋œ ์–ธ์–ด C/C++, C#, Go, Java, Kotlin, Rust(๊ณต๊ฐœ ๋ฏธ๋ฆฌ ๋ณด๊ธฐ), ๋ฐ Swift, CodeQL ์ค‘์—์„œ ์›๋ณธ ํŒŒ์ผ์ด ๊ฐ€์žฅ ๋งŽ์€ ์–ธ์–ด๋งŒ ๋ถ„์„ํ•ฉ๋‹ˆ๋‹ค. ์›Œํฌํ”Œ๋กœ๋ฅผ ํŽธ์ง‘ํ•˜๊ณ  ๋ถ„์„ํ•  ์–ธ์–ด๋ฅผ ์ง€์ •ํ•˜๋Š” ํ–‰๋ ฌ์„ ์ถ”๊ฐ€ํ•ฉ๋‹ˆ๋‹ค. ๊ธฐ๋ณธ๊ฐ’ CodeQL ๋ถ„์„ ์›Œํฌํ”Œ๋กœ๋Š” ์ด๋Ÿฌํ•œ ํ–‰๋ ฌ์„ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค.

์›Œํฌํ”Œ๋กœ์˜ ๋‹ค์Œ ์ถ”์ถœ์€ ์ž‘์—… ์ „๋žต ๋‚ด์—์„œ ํ–‰๋ ฌ์„ ์‚ฌ์šฉํ•˜์—ฌ ์–ธ์–ด๋ฅผ ์ง€์ •ํ•œ ๋‹ค์Œ โ€œCodeQLโ€ ๋‹จ๊ณ„ ๋‚ด์—์„œ ๊ฐ ์–ธ์–ด๋ฅผ ์ฐธ์กฐํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ๋ณด์—ฌ ์ค๋‹ˆ๋‹ค.

jobs:
  analyze:
    permissions:
      security-events: write
      actions: read
    # ...
    strategy:
      fail-fast: false
      matrix:
        language: ['csharp', 'c-cpp', 'javascript-typescript']

    steps:
    # ...
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}

์›Œํฌํ”Œ๋กœ ํŽธ์ง‘์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ ์ฝ”๋“œ ๊ฒ€์ƒ‰์„ ์œ„ํ•œ ๊ณ ๊ธ‰ ์„ค์ • ์‚ฌ์šฉ์ž ์ง€์ •์„(๋ฅผ) ์ฐธ์กฐํ•˜์„ธ์š”.