LGTM is being deprecated in favor of CodeQL - https://github.blog/2022-08-15-the-next-step-for-lgtm-com-github-code-scanni...
They have submitted several PRs to system roles repos to switch from LGTM to CodeQL - https://github.com/linux-system-roles/storage/pull/309
Questions for the community: * Do we need LGTM? Is it useful? Can you give us an example of a problem found by LGTM that would not have been found otherwise? * Does anyone have any experience with CodeQL? How is it?
If LGTM isn't useful, I'd like to get rid of it. If LGTM is useful, I'll merge the PRs (and remove .lgtm.yml from our repos)
Or perhaps there is a better tool we should use instead?
Hi Rich,
On Thu, Dec 1, 2022 at 2:50 AM Richard Megginson rmeggins@redhat.com wrote:
LGTM is being deprecated in favor of CodeQL - https://github.blog/2022-08-15-the-next-step-for-lgtm-com-github-code-scanni...
They have submitted several PRs to system roles repos to switch from LGTM to CodeQL - https://github.com/linux-system-roles/storage/pull/309
Questions for the community:
- Do we need LGTM? Is it useful? Can you give us an example of a problem found by LGTM that would not have been found otherwise?
- Does anyone have any experience with CodeQL? How is it?
My understanding from reading the blog post above and chatting to people in other affected communities is that LGTM is being completely shutdown & replaced with CodeQL (AIUI Microsoft bought LGTM awhile back and have now apparently incorporated all its features into CodeQL).
If LGTM isn't useful, I'd like to get rid of it. If LGTM is useful, I'll merge the PRs (and remove .lgtm.yml from our repos)
Or perhaps there is a better tool we should use instead?
Not that I know of. We use Coverity (in addition) on several other projects I work on but not sure that's particularly useful in an Ansible context.
cheers.
-- Nathan
systemroles mailing list -- systemroles@lists.fedorahosted.org To unsubscribe send an email to systemroles-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/systemroles@lists.fedorahosted.... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi,
Am Mi., 30. Nov. 2022 um 16:50 Uhr schrieb Richard Megginson < rmeggins@redhat.com>:
LGTM is being deprecated in favor of CodeQL - https://github.blog/2022-08-15-the-next-step-for-lgtm-com-github-code-scanni...
They have submitted several PRs to system roles repos to switch from LGTM to CodeQL - https://github.com/linux-system-roles/storage/pull/309
Questions for the community:
- Do we need LGTM? Is it useful? Can you give us an example of a problem
found by LGTM that would not have been found otherwise?
when I introduced LGTM to the network role in 2019, it found this issue: https://lgtm.com/rules/10030086/
Not sure, if there was any practical impact. The value of services like these come from the fact that they support reviewers from not having to deal with issues that can be found automatically so the reviewers can focus on issues that need a human brain to be found. There does not seem to be statistics available about how many PRs failed LGTM at some point and then were fixed by the contributor without the reviewer needing to step in. @Thomas Haller thaller@redhat.com fixed some issues in NetworkManager based on LGTM results that he considered valued and that were not found otherwise but that is a C project.
* Does anyone have any experience with CodeQL? How is it?
I let it finish the run on the network role and at first glance it seems to identify valid issues: https://github.com/linux-system-roles/network/pull/543/checks?check_run_id=9... I would like to keep it for the network role.
If LGTM isn't useful, I'd like to get rid of it.
If LGTM is useful, I'll merge the PRs (and remove .lgtm.yml from our repos)
I guess you mean CodeQL here. For the network role, I would prefer to get the issues fixed before merging the CodeQL PR and the LGTM badge also needs to be removed from the README. @Stanislas Faye sfaye@redhat.com @Wen Liang wenliang@redhat.com please consider this for the upcoming sprint.
Cheers Till
Or perhaps there is a better tool we should use instead?
systemroles mailing list -- systemroles@lists.fedorahosted.org To unsubscribe send an email to systemroles-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/systemroles@lists.fedorahosted.... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On Thu, Dec 1, 2022 at 2:35 AM Till Maas till@redhat.com wrote:
Hi,
Am Mi., 30. Nov. 2022 um 16:50 Uhr schrieb Richard Megginson < rmeggins@redhat.com>:
LGTM is being deprecated in favor of CodeQL - https://github.blog/2022-08-15-the-next-step-for-lgtm-com-github-code-scanni...
They have submitted several PRs to system roles repos to switch from LGTM to CodeQL - https://github.com/linux-system-roles/storage/pull/309
Questions for the community:
- Do we need LGTM? Is it useful? Can you give us an example of a
problem found by LGTM that would not have been found otherwise?
when I introduced LGTM to the network role in 2019, it found this issue: https://lgtm.com/rules/10030086/
Not sure, if there was any practical impact. The value of services like these come from the fact that they support reviewers from not having to deal with issues that can be found automatically so the reviewers can focus on issues that need a human brain to be found. There does not seem to be statistics available about how many PRs failed LGTM at some point and then were fixed by the contributor without the reviewer needing to step in. @Thomas Haller thaller@redhat.com fixed some issues in NetworkManager based on LGTM results that he considered valued and that were not found otherwise but that is a C project.
- Does anyone have any experience with CodeQL? How is it?
I let it finish the run on the network role and at first glance it seems to identify valid issues:
https://github.com/linux-system-roles/network/pull/543/checks?check_run_id=9... I would like to keep it for the network role.
If LGTM isn't useful, I'd like to get rid of it.
If LGTM is useful, I'll merge the PRs (and remove .lgtm.yml from our repos)
I guess you mean CodeQL here. For the network role, I would prefer to get the issues fixed before merging the CodeQL PR and the LGTM badge also needs to be removed from the README. @Stanislas Faye sfaye@redhat.com @Wen Liang wenliang@redhat.com please consider this for the upcoming sprint.
Ok. I've added a task for the system roles core team for the other roles.
Cheers Till
Or perhaps there is a better tool we should use instead?
systemroles mailing list -- systemroles@lists.fedorahosted.org To unsubscribe send an email to systemroles-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/systemroles@lists.fedorahosted.... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
-- Till Maas He/His/Him Manager, Software Engineering NetworkManager, Nmstate, Ansible RHEL Networking System Role
Red Hat GmbH, https://www.redhat.com/de/global/dach, Registered seat: Werner von Siemens Ring 12, 85630 Grasbrunn, Germany Commercial register: Amtsgericht Muenchen/Munich, HRB 153243, Managing Directors: Ryan Barnhart, Charles Cachera, Michael O'Neill, Amy Ross
systemroles@lists.fedorahosted.org