Hi @ihsinme! We're indeed actively working on features that will replace the query console (and more). We're currently testing these features with a group of beta testers. Are you a member of the GitHub Security Lab Slack channels, and if so: what's your handle there? We might be able to enrol you into the beta.

thanks for the answer.
my account in slack is ihsinme@gmail.com

Fantastic. We'll be in touch on Slack, likely next week! And of course you can continue to use LGTM in the meantime 🙂

thanks, I'll wait.

Yes, indeed there will be! That feature is being tested at the moment and will be announced soon.

Are you already enrolled in the beta testing programme for the query console replacement? If not: are you a member of the GitHub Security Lab Slack channels, and if so: what's your handle there? We might be able to enrol you into the beta.

Oh, nice, I was a bit afraid it would no longer be possible! I'm not enrolled but interested, should I request an invite to the GitHub Security Lab Slack via mail then?

Yes, that'd be great. And once you've been given access, please ping me here and we'll take it from there!

Yes now I'm on the Github Security Lab Slack, my handle is @Mahé!

Fantastic. We'll be in touch on Slack, likely next week! And of course you can continue to use LGTM in the meantime 🙂

Depending on exactly what you use LGTM for, there are two options:

1. If you use LGTM to identify potential vulnerabilities using its out-of-the-box security analysis, then your best option is to create a mirror of your source code on GitHub.com and enable code scanning on that. GitHub code scanning runs the exact same security analysis as LGTM; both use the same CodeQL analysis engine. Your results will then appear on the "Security" tab on GitHub.com.

2. If you use LGTM for writing and running your own CodeQL queries to perform custom manual security analysis: you can actually use CodeQL on repositories hosted on GitLab and Bitbucket (license details here).

Hope that makes sense!

Would the updated source code of LGTM.io be pushed for archival purposes at lgtmco/lgtm? I'm sure that many people (myself included) would love to pour over old code.

If not, that's fine (although a little disappointing, tbh).

LGTM.com and lgtmco/lgtm are unrelated projects. We currently don't have any plans to open-source the LGTM.com web application, but of course all of our security analyses (CodeQL queries) are already open source: https://github.com/github/codeql!

Shame. If you would be so kind, please, please, please try to push for that. Often times when websites get shut down, their source code become lost to time. I really hope that the same won't happen to LGTM.com.

Thanks anyways!

Great; leave a comment here when you have access to the Slack channels (shouldn't take long) and we'll take it from there!

Thanks, I have access now, email is goatsniffing@gmail.com

We're working on features in this area. Are you a member of the GitHub Security Lab Slack channels? If not: do join! From there we'll be able to add you to the beta testing programme for features like this.

There was a temporary outage — everything is working again as it should. This was unrelated to the gradual deprecation.

As to your first question: code scanning focusses 🎯 on security and therefore by default only shows you alerts that are related to security. LGTM, on the other hand, also flags up code quality results — most people care less about those.

However, if you want to see more alerts, you could consider enabling the security-and-quality pack for CodeQL. See here for information about that.

About your second question regarding alert severities: these are now based on historical CVE/CWE data 📈. You can find more information about that in this announcement here.

Hope that helps!

Helped a lot! Thank you!
Would be nice if you could add it directly into the sample config, so people can just uncomment it, if they need it!

Hi @Marcono1234
Thanks for asking about the query console replacement. I'll reach out on Slack to discuss further.

I also want to join, My user name on the GitHub Security Slack channel is SummerSec (same as on GitHub). @jf205

Thanks @SummerSec. Let's discuss further on Slack.

That sounds like a topic that's unrelated to the gradual deprecation of LGTM.com. Would you mind opening a separate new Discussion so we can dive deeper into exactly what you mean and are trying to achieve? Thanks!

Hi @agrimsachdeva. Let's talk about this on Slack!

Hi @Andrey1994

Hopefully the automated PRs will land before the end of October, which is still a week away 😄 . Thanks for your patience while we work on this.

It looks like for that project code scanning with CodeQL is already set up though: https://github.com/brainflow-dev/brainflow/blob/master/.github/workflows/codeql_analysis.yml
Maybe that is the reason why the no pull request was generated?

👋 @TurboTurtle

The way you are adding paths is very similar to how you can avoid running the CodeQL workflow when changes happen in specific files - see Avoiding unnecessary scans of pull requests.

In order to actually avoid the scanning of specific paths by CodeQL itself, you may use a CodeQL configuration file - a file located in your repository, provided to the github/codeql-action/init workflow. To create this file, check Example configuration files.

Thanks @jorgectf - that seems to be working for us.

Hi @DLesage25
Thank you for the question. Currently, we do not consider adding code quality score badges to the repo. However, we will make sure to consider this or similar future improvements.

@AlonaHlobina I don't really understand why the original blog post brags about offering more than what LGTM offered, when obviously, we'll be loosing our code quality scoring and badges -- which means that the current offering isn't the boasted superset of current functionalities. Don't get me wrong: I'm grateful for all the stuff that I'm getting now, but I think the original blog post could have been much more transparent (honest) about the actual state of affairs.

Anyway, please consider code quality indication an important feature: while at the top of this thread it says "people care less", I think it's more like "many people don't care" but also "some people care a lot".

So, like the original poster, I'd like beg you to please consider adding code quality back in!

Thank you very much, @DLesage25 and @ehuelsmann, for your feedback. We will seriously consider badges for the near future.
Perhaps you could think of jumping on a 30 min call with me to help understand better the importance of badges? I would love to see how you use our technology and what we can improve. GitHub runs a gratitude program to reward users for speaking with us. I would love to talk to you.

Isn't it kind of obvious GitHub is all about badges ;)

Hi @roastduck! We've so far filed over 6000 automatically-generated pull requests, and over 200 manually-crafted PRs. I had a quick look as to why your repository hasn't received a PR, and that's actually to do with your specific lgtm.yml configuration: it has some pretty cool detailed build steps in it that we haven't been able to convert automatically.

Next week we'll start opening PRs for the relatively small number of repositories that we couldn't automatically create workflow files for. Those PRs will contain workflow configurations that unfortunately don't work yet and therefore need extra attention 👀 from developers.

If you don't mind taking a closer look yourself, then it's probably best if you try creating a CodeQL workflow file manually. No need to wait for us! And I'm sorry we weren't able to auto-generate it for you.

Hi @afehnker

We're working on features that will replace LGTM's query writing features. There's actually a beta test currently happening that you might be interested in. If you haven't already, I'd recommend joining the GitHub Security Lab Slack channels. One you're in we can talk about adding you to the beta test 🙂

Hi @awick

I haven't taken a look at your repo in much detail, so I'm not if we are able to automatically generate a migration PR for you. In the meantime, please could you try following the docs to set it up yourself? If you need any extra assistance please follow up and we'll see what we can do. Thanks! 🙂

Hi @roastduck,

Thank you for the question. You can now exclude the files in specific directories from analysis by adding a paths-ignore array only for the interpreted languages like Python, Ruby and JavaScript/TypeScript.

The code scanning team will work on adding support for this functionality for all CodeQL-supported languages in the nearest future.
Meanwhile, for compiled languages, you must specify appropriate build steps in the workflow to limit code scanning to specific directories in your project. The commands you need to use to exclude a directory from the build will depend on your build system. Please see more info on "Configuring the CodeQL workflow for compiled languages."

Thanks for your reply.

I am really looking forward to the paths-ignore feature for C++.

As for ignoring the directories in the build phase, however, I don't think it works for my case. In my case, the repo can only be built with all source directories including the third-party directories (which are to be ignored). Therefore, I cannot ignore those directories in the building phase. This is different from ignoring a "test" directory, which can be ignored from build. Instead, I hope I can only ignore them from analysis, or ignore their analysis results.

The PR was automatically generated from your existing .lgtm.yml configuration, which specifies this exact same exclusion. That was perhaps not what was originally intended, though.

The specified exclusion in the .lgtm.yml file stops a particular CodeQL query (with id ext) from running, rather than exclude a directory from analysis.

There's another thread just above that discusses paths-ignore for C/C++. Unfortunately this feature isn't available yet for C/C++ analyses.

@sj Thanks, I had seen the comments about paths-ignore and wanted to be sure it was the same thing.

Any ETA on this? It makes things somewhat difficult for any C++ application with less than ideal third party libraries.

Hey @sj
do you know if this should work now?
I've tried paths-ignore: but it's still taking third party sources

Hi @AirSkye

Our new feature for running CodeQL queries at scale is now publicly available: Multi-repository variant analysis

Please take a look 🙂