Gradual deprecation of LGTM.com

[sj]

On the 15th of August, we announced the gradual deprecation of LGTM.com on the GitHub blog 📝. For more information, please take a look at that post — it contains key dates and information about migrating to GitHub code scanning.

If you have any questions or comments, feel free to discuss this news below. We'll do our best to answer any questions you might have!

[ihsinme]

good afternoon.
I use the query console at lgtm.com extensively.
after closing I will lose this opportunity(.
Could you let me know if there are options for similar functionality in the future?
there may be plans to open source lgtm.com for self-deployment and use.

Thanks.

[sj]

Hi @ihsinme! We're indeed actively working on features that will replace the query console (and more). We're currently testing these features with a group of beta testers. Are you a member of the GitHub Security Lab Slack channels, and if so: what's your handle there? We might be able to enrol you into the beta.

[ihsinme]

thanks for the answer.
my account in slack is [email protected]

[sj]

Fantastic. We'll be in touch on Slack, likely next week! And of course you can continue to use LGTM in the meantime 🙂

[ihsinme]

thanks, I'll wait.

[mtardy]

Will there be any way of downloading the CodeQL databases of various projects to query offline (like it is today on LGTM)?

[sj]

Yes, indeed there will be! That feature is being tested at the moment and will be announced soon.

Are you already enrolled in the beta testing programme for the query console replacement? If not: are you a member of the GitHub Security Lab Slack channels, and if so: what's your handle there? We might be able to enrol you into the beta.

[mtardy]

Oh, nice, I was a bit afraid it would no longer be possible! I'm not enrolled but interested, should I request an invite to the GitHub Security Lab Slack via mail then?

[sj]

Yes, that'd be great. And once you've been given access, please ping me here and we'll take it from there!

[mtardy]

Yes now I'm on the Github Security Lab Slack, my handle is @Mahé!

[sj]

Fantastic. We'll be in touch on Slack, likely next week! And of course you can continue to use LGTM in the meantime 🙂

[lunaisnotaboy]

If I'm using LGTM with GitLab and BitBucket, what could I do to continue code analysis after LGTM shuts down?

[sj]

Depending on exactly what you use LGTM for, there are two options:

1. If you use LGTM to identify potential vulnerabilities using its out-of-the-box security analysis, then your best option is to create a mirror of your source code on GitHub.com and enable code scanning on that. GitHub code scanning runs the exact same security analysis as LGTM; both use the same CodeQL analysis engine. Your results will then appear on the "Security" tab on GitHub.com.

2. If you use LGTM for writing and running your own CodeQL queries to perform custom manual security analysis: you can actually use CodeQL on repositories hosted on GitLab and Bitbucket (license details here).

Hope that makes sense!

[lunaisnotaboy]

Would the updated source code of LGTM.io be pushed for archival purposes at lgtmco/lgtm? I'm sure that many people (myself included) would love to pour over old code.

If not, that's fine (although a little disappointing, tbh).

[sj]

LGTM.com and lgtmco/lgtm are unrelated projects. We currently don't have any plans to open-source the LGTM.com web application, but of course all of our security analyses (CodeQL queries) are already open source: https://github.com/github/codeql!

[lunaisnotaboy]

Shame. If you would be so kind, please, please, please try to push for that. Often times when websites get shut down, their source code become lost to time. I really hope that the same won't happen to LGTM.com.

Thanks anyways!

[BillyNoGoat]

Hey, I work as an AppSec Engineer and have been actively using LGTM for a research piece I'm doing with CodeQL, is there anyone I can contact to plead my case for beta access 😅?
I'm also not in the slack (I only just found out it existed) but I've just requested access.
Thanks

[sj]

Great; leave a comment here when you have access to the Slack channels (shouldn't take long) and we'll take it from there!

[BillyNoGoat]

Thanks, I have access now, email is [email protected]

[the-xentropy]

Hey, I think this is a natural move, but will you be introducing any new functionality to GitHub to make it possible to easily list which projects have CodeQL databases built to bring it up to par with LGTM in this regard? One of the major reasons I used LGTM.com is because the UI makes it possible to exhaustively navigate projects which have public databases, whereas on GitHub unless I'm missing some major UX you have to navigate to each project and check if it does or not (and usually the answer is it does not) one by one, as opposed to just navigate a big list of projects which we know have databases (cutting down a lot of work when e.g. picking a security research project).

[sj]

We're working on features in this area. Are you a member of the GitHub Security Lab Slack channels? If not: do join! From there we'll be able to add you to the beta testing programme for features like this.

[Marcono1234]

It looks like the Query Console is not working at the moment. Even for the simplest queries (such as select "hello world") it shows:

Failed to run query: The job exited with a non-zero exit code

(Query Console link)

Is this related to the deprecation and is it a known issue?

[sj]

There was a temporary outage — everything is working again as it should. This was unrelated to the gradual deprecation.

[Lemongrass3110]

Hey @sj,

I introduced CodeQL for our repository yesterday (rathena/rathena#7208). Basically I totally understand the motive and reasoning for this move and support it. And great work so far!

The only thing I am disappointed about is that CodeQL gives us only 6 alerts (the severity levels are questionable in my eyes) whereas LGTM gave us 69 alerts. So 10x more alerts. Do we need to configure additional queries or what is the reason why we miss so many alerts that were found on LGTM?

Also will the severity levels be harmonized to the scores they had on LGTM? It feels like the severities on LGTM where much more accurate than they are now on CodeQL.

Thanks in advance for your help!

[sj]

As to your first question: code scanning focusses 🎯 on security and therefore by default only shows you alerts that are related to security. LGTM, on the other hand, also flags up code quality results — most people care less about those.

However, if you want to see more alerts, you could consider enabling the security-and-quality pack for CodeQL. See here for information about that.

About your second question regarding alert severities: these are now based on historical CVE/CWE data 📈. You can find more information about that in this announcement here.

Hope that helps!

[Lemongrass3110]

Helped a lot! Thank you!
Would be nice if you could add it directly into the sample config, so people can just uncomment it, if they need it!

[Marcono1234]

If possible I would like to beta-test the Query Console replacement, though I did not use the Query Console that actively during the past weeks. Therefore if there is a limit on the number of beta testers, I won't mind if I can't become one.

My user name on the GitHub Security Slack channel is Marcono1234 (same as on GitHub).

[jf205]

Hi @Marcono1234
Thanks for asking about the query console replacement. I'll reach out on Slack to discuss further.

[SummerSec]

I also want to join, My user name on the GitHub Security Slack channel is SummerSec (same as on GitHub). @jf205

[jf205]

Thanks @SummerSec. Let's discuss further on Slack.

[apple502j]

Is it possible to use CodeQL action workflow without uploading security alerts (i.e. as a Pull Request check only)?

[sj]

That sounds like a topic that's unrelated to the gradual deprecation of LGTM.com. Would you mind opening a separate new Discussion so we can dive deeper into exactly what you mean and are trying to achieve? Thanks!

[agrimsachdeva]

Hi sj, I am a security researcher at Indiana University, and I was wondering if you could please help with accessing reports that already exist on LGTM - would the API be the best way? I am unable to sign up as a new user.

Finally, I also joined the slack..

[jf205]

Hi @agrimsachdeva. Let's talk about this on Slack!

[Andrey1994]

Hi!

I am an author of several projects which use LGTM(e.g. https://github.com/brainflow-dev/brainflow)

According to https://github.blog/2022-08-15-the-next-step-for-lgtm-com-github-code-scanning/ we should get some automated PRs for migration but its already the end of October and there is nothing.

So, should we do it by ourselves or wait a little more?

[jf205]

Hi @Andrey1994

Hopefully the automated PRs will land before the end of October, which is still a week away 😄 . Thanks for your patience while we work on this.

[Marcono1234]

It looks like for that project code scanning with CodeQL is already set up though: https://github.com/brainflow-dev/brainflow/blob/master/.github/workflows/codeql_analysis.yml
Maybe that is the reason why the no pull request was generated?

[TurboTurtle]

Hello,

We use LGTM and recently got the PR for switching to GH code scanning - sosreport/sos#3064. The initial change was functional, but we noticed that it was highlighting a large amount of alerts from our test suite, which we don't want scanned.

Looking at the docs it seems like this should easily be remedied by adding a paths array.

I did that, committing directly to lgtm's fork via the GH webUI, but the action is now failing saying that paths is unexpected - https://github.com/sosreport/sos/actions/runs/3447321918.

So, if it's not the documented paths array, what do we need to add to the configuration to limit scanning the specified directory in the repo?

[jorgectf]

👋 @TurboTurtle

The way you are adding paths is very similar to how you can avoid running the CodeQL workflow when changes happen in specific files - see Avoiding unnecessary scans of pull requests.

In order to actually avoid the scanning of specific paths by CodeQL itself, you may use a CodeQL configuration file - a file located in your repository, provided to the github/codeql-action/init workflow. To create this file, check Example configuration files.

[TurboTurtle]

Thanks @jorgectf - that seems to be working for us.

[DLesage25]

Hi!

This is kind of a silly question - are there plans for supporting the former LGTM badges that could be added to repo readmes that showed a code quality score?

Even if a secondary feature, it was definitely nice to have a badge showing a clean score on my public repos. :)

[AlonaHlobina]

Hi @DLesage25
Thank you for the question. Currently, we do not consider adding code quality score badges to the repo. However, we will make sure to consider this or similar future improvements.

[ehuelsmann]

@AlonaHlobina I don't really understand why the original blog post brags about offering more than what LGTM offered, when obviously, we'll be loosing our code quality scoring and badges -- which means that the current offering isn't the boasted superset of current functionalities. Don't get me wrong: I'm grateful for all the stuff that I'm getting now, but I think the original blog post could have been much more transparent (honest) about the actual state of affairs.

Anyway, please consider code quality indication an important feature: while at the top of this thread it says "people care less", I think it's more like "many people don't care" but also "some people care a lot".

So, like the original poster, I'd like beg you to please consider adding code quality back in!

[AlonaHlobina]

Thank you very much, @DLesage25 and @ehuelsmann, for your feedback. We will seriously consider badges for the near future.
Perhaps you could think of jumping on a 30 min call with me to help understand better the importance of badges? I would love to see how you use our technology and what we can improve. GitHub runs a gratitude program to reward users for speaking with us. I would love to talk to you.

[uNetworkingAB]

Isn't it kind of obvious GitHub is all about badges ;)

[roastduck]

Hi!

One of my repository (https://github.com/roastduck/FreeTensor) uses LGTM, and I should have gotten an automated PR for migration, but there is not. I see there was some delay mentioned in another post in this discussion, but now it is the end of November, and there is only less than two weeks before the planned disabling. Should I wait more or set up it by ourselves?

Thanks in advance.

[sj]

Hi @roastduck! We've so far filed over 6000 automatically-generated pull requests, and over 200 manually-crafted PRs. I had a quick look as to why your repository hasn't received a PR, and that's actually to do with your specific lgtm.yml configuration: it has some pretty cool detailed build steps in it that we haven't been able to convert automatically.

Next week we'll start opening PRs for the relatively small number of repositories that we couldn't automatically create workflow files for. Those PRs will contain workflow configurations that unfortunately don't work yet and therefore need extra attention 👀 from developers.

If you don't mind taking a closer look yourself, then it's probably best if you try creating a CodeQL workflow file manually. No need to wait for us! And I'm sorry we weren't able to auto-generate it for you.

[afehnker]

I have been using the LGTM interface in a software engineering unit, that covered static analysis. The nice thing was that student could simply write their own checks and run them on GitHub repos. Is there any way to do it as easily with codeQL as with LGTM? Sure, the language is the same, but I wonder about the interface.

[jf205]

Hi @afehnker

We're working on features that will replace LGTM's query writing features. There's actually a beta test currently happening that you might be interested in. If you haven't already, I'd recommend joining the GitHub Security Lab Slack channels. One you're in we can talk about adding you to the beta test 🙂

[awick]

Hi, was wondering if we could get an automated migration PR for https://github.com/arkime/arkime thanks!!

[jf205]

Hi @awick

I haven't taken a look at your repo in much detail, so I'm not if we are able to automatically generate a migration PR for you. In the meantime, please could you try following the docs to set it up yourself? If you need any extra assistance please follow up and we'll see what we can do. Thanks! 🙂

[roastduck]

Hi, I am trying to exclude some directories from scanning. I wrote a custom configuration file containing a paths-ignore field, but I got the following warning:

Warning: The "paths"/"paths-ignore" fields of the config only have effect for JavaScript, Python, and Ruby

However, I am analyzing for C++. Can I configure this exclusion for a C++ analysis? If not, can I hide the alerts for some directories (just like path_classifiers in LGTM)? Otherwise I would get many alerts from 3rd-party submodules.

Thanks!

[AlonaHlobina]

Hi @roastduck,

Thank you for the question. You can now exclude the files in specific directories from analysis by adding a paths-ignore array only for the interpreted languages like Python, Ruby and JavaScript/TypeScript.

The code scanning team will work on adding support for this functionality for all CodeQL-supported languages in the nearest future.
Meanwhile, for compiled languages, you must specify appropriate build steps in the workflow to limit code scanning to specific directories in your project. The commands you need to use to exclude a directory from the build will depend on your build system. Please see more info on "Configuring the CodeQL workflow for compiled languages."

[roastduck]

Thanks for your reply.

I am really looking forward to the paths-ignore feature for C++.

As for ignoring the directories in the build phase, however, I don't think it works for my case. In my case, the repo can only be built with all source directories including the third-party directories (which are to be ignored). Therefore, I cannot ignore those directories in the building phase. This is different from ignoring a "test" directory, which can be ignored from build. Instead, I hope I can only ignore them from analysis, or ignore their analysis results.

[PhilipDeegan]

Hi, I'm building/reviewing the automatic PR created for my C++ project by lgtm-migrator
There's a new file added ".github/codeql.yml

query-filters:
  - exclude:
      id: ext

this "ext" directory contains third party libraries/code that should not be included as part of LGTM scanning, except it doesn't seem to exclude these directories from scanning

[sj]

The PR was automatically generated from your existing .lgtm.yml configuration, which specifies this exact same exclusion. That was perhaps not what was originally intended, though.

The specified exclusion in the .lgtm.yml file stops a particular CodeQL query (with id ext) from running, rather than exclude a directory from analysis.

There's another thread just above that discusses paths-ignore for C/C++. Unfortunately this feature isn't available yet for C/C++ analyses.

[PhilipDeegan]

@sj Thanks, I had seen the comments about paths-ignore and wanted to be sure it was the same thing.

Any ETA on this? It makes things somewhat difficult for any C++ application with less than ideal third party libraries.

[PhilipDeegan]

Hey @sj
do you know if this should work now?
I've tried paths-ignore: but it's still taking third party sources

[aaronlippold]

Can you please remove all MITRE GitHub org projects from lgtm.com.

github.com/mitre/heimdall2
github.com/mitre/saf
github.com/mitre/emasser
...

Thank you and let us know if we need to take any actions

[AirSkye]

Hello, my account is @Air Sky , can I join the LGTM beta?

[jf205]

Hi @AirSkye

Our new feature for running CodeQL queries at scale is now publicly available: Multi-repository variant analysis

Please take a look 🙂