feat: add codeql scheduled cronjob #214
Conversation
Signed-off-by: sakshi-1505 <[email protected]>
Signed-off-by: sakshi-1505 <[email protected]>
|
@codeboten Please check this |
| # │ │ │ │ │ | ||
| # │ │ │ │ │ | ||
| # * * * * * | ||
| - cron: '30 1 * * *' |
There was a problem hiding this comment.
I'm not sure we should have it periodically. Upon merge and on PRs should be sufficient.
There was a problem hiding this comment.
I had been checking the other projects which are mark complete, they had cron schedule too. But I just read the advisory here open-telemetry/sig-security#15 & looks like we only need to merge & prs against main
There was a problem hiding this comment.
I think a cron schedule is actually very useful. Often you will not introduce a security issue on merge, but it will pop up without code changes, simply because it is later discovered that it was already there but not known yet.
This is especially of interest if we don't merge anything for a while.
There was a problem hiding this comment.
What should be the next step here folks?
There was a problem hiding this comment.
@Oberon00 has a good point, feel free to keep the scheduled runs.
There was a problem hiding this comment.
Can we get this approved then @jpkrohling
There was a problem hiding this comment.
@sakshi-1505 / @jpkrohling is this still relevant?
There was a problem hiding this comment.
In practice, this project is actually split between three different projects (at least):
Semconv generator, Protobuf and CPP tooling.
I'm concerned about two things with this repo:
- Lack of attention from those named to own the repo (myself included)
- Very broad set of responsibilities across OTEL with true owners (e.g. CPP tooling) being a different SiG.
For now, would you be willing to do codeql analysis separately on each subdirectory so we get a different alert/error notification and direct to the "true" owners?
refers #212