Code scanning logs

You can view the output generated during code scanning analysis in GitHub.

이 문서의 내용

The log and diagnostic information available to you depends on the method you use for code scanning in your repository. You can check the type of code scanning you're using in the Security tab of your repository, by using the Tool drop-down menu in the alert list. To access this page, see 리포지토리에 대한 코드 검사 경고 평가.

Logs on GitHub

You can see analysis and diagnostic information for code scanning run using CodeQL analysis on GitHub.

Summary metrics

요약 메트릭에는 다음이 포함됩니다.

  • CodeQL 데이터베이스를 만들고 추출하기 전의 코드베이스의 코드 줄(기준으로 사용)
  • 코드에서 추출된 CodeQL 데이터베이스(외부 라이브러리 및 자동 생성된 파일 포함)의 코드 줄
  • CodeQL 데이터베이스(자동 생성된 파일 및 외부 라이브러리 제외)의 코드 줄

Source code extraction diagnostics

추출기 진단은 분석 중에 확인된 파일만을 다룹니다. 메트릭은 다음과 같습니다.

  • 성공적으로 분석된 파일 수
  • 데이터베이스를 만드는 동안 추출기 오류가 발생한 파일 수
  • 데이터베이스를 만드는 동안 추출기 경고가 발생한 파일 수

You can see more detailed information about CodeQL extractor errors and warnings that occurred during database creation by enabling debug logging. See 로그가 충분히 상세하지 않음.

Diagnostic information for private package registries

Code scanning default setup workflows include a Setup proxy for registries step. When you are looking at a workflow run for default setup, you can expand this step to view the corresponding log. This contains information about which private package registry configurations were available to the analysis. Additionally, the log contains some diagnostic information which may help with troubleshooting if the private package registries are not successfully used by code scanning default setup. Look for the following messages:

  • Using registries_credentials input. At least one private registry is configured for the organization. This includes configurations for private registry types which are not supported by code scanning default setup. For more details about supported registry types, see 프라이빗 레지스트리에 대한 보안 기능 액세스 부여.

  • Credentials loaded for the following registries:

    • If no list of configurations follows, then no private registry configurations supported by code scanning default setup were found.
    • Otherwise, one line for each supported configuration that was successfully loaded is shown. For example, a line containing Type: nuget_feed; Host: undefined; Url: https://nuget.pkg.github.com/; Username: undefined; Password: true; Token: false indicates that a private NuGet Feed configuration was loaded.
    • The information about the configuration in the log may not match exactly what is configured for the organization in the UI. For example, the log may indicate that a Password is set, even though a Token is configured in the UI.

  • Proxy started on 127.0.0.1:49152 The authentication proxy that is used by code scanning default setup to authenticate to the configured private package registries was started successfully.

  • Following this, there may be messages about the outcomes of connection tests which try to reach the configured private package registries through the authentication proxy. This is a best-effort process. If these checks are not successful for some registries, it does not necessarily mean that the relevant configurations are not working. However, if you find that code scanning default setup is unable to successfully access dependencies in the private registries during the analysis, then this may provide some information to help troubleshoot the issue.

If the output from the Setup proxy for registries step is as expected, but code scanning default setup is unable to successfully access dependencies in the private registries, you can obtain additional troubleshooting information. See 로그가 충분히 상세하지 않음.

For more information about giving code scanning default setup access to private registries, see 프라이빗 레지스트리에 대한 보안 기능 액세스 부여.

Logs for the CodeQL CLI

If you're using the CodeQL CLI outside GitHub, you'll see diagnostic information in the output generated during database analysis. This information is also included in the SARIF results file.

Logs in VS Code

Progress and error messages are displayed as notifications in the bottom right corner of the Visual Studio Code workspace. These link to more detailed logs and error messages in the "Output" window.

You can access separate logs for the CodeQL extension, language server, query Server, or tests. The Language Server log contains more advanced debug logs for CodeQL language maintainers. You should only need these to provide details in a bug report.

To access these logs, see Accessing logs for CodeQL in Visual Studio Code.