enable codeQL

[jukzi]

CodeQL https://codeql.github.com/ can hint to problems in sourcecode

Unlike SonarCube it tries to produce warnings only for serious flaws.

Which are only a few for platform.ui as an example:
https://github.com/jukzi/eclipse.platform.ui/security/code-scanning

[HeikoKlare]

Looks interesting. I cannot see the scan for your platform.ui clone, @jukzi. Can you set it public or post the results? Thanks!

[jukzi]

(was scrrenshot)

[jukzi]

i don't find a button to make it public. however it's even a good feature, that such reports can only be seen by commiters.

[HeikoKlare]

Valid point 🙂 Thanks for sharing the results!

[HannesWell]

Sounds good to me.

[jukzi]

when logged in, can you see
https://github.com/eclipse-platform/eclipse.platform.ui/security/code-scanning?query=pr%3A986
?

[merks]

I can see that page.

[jukzi]

I enabled codeQL for platform.ui. You can see the results in the security tab:

https://github.com/eclipse-platform/eclipse.platform.ui/security/code-scanning

@carstenartur
i see you tried similar on eclipse-platform/eclipse.platform.ui#175
if you have any improvement please let us know.