Analyze (csharp) No code found during the build

[Subharanjan2055]

Hi ,

I have been trying to build & codescan one dotnet Console applications . Its building the applications but in the perform codeql analysis step its failing and throwing No source code was seen and extracted
Please note only one .cs file is available which is main source code file . How to perform codeql analysis for single file please let me know.

[MathiasVP]

Hi @Subharanjan2055,

How to perform codeql analysis for single file please let me know.

There's nothing special about analysing a single file. If the project builds then we should be able to analyse it.

Do you have a link to a workflow run where the No source code was seen and extracted error appears? If possible, it would be really helpful to have a run with debugging enabled (as this will help our CodeQL engineers figure out what's going on). You can see how to enable debug logging here: https://github.blog/changelog/2022-08-01-debugging-codeql-analysis-in-code-scanning-made-easier-by-obtaining-detailed-logs-and-debugging-artifacts-from-the-codeql-action/

[Subharanjan2055]

Hi @MathiasVP ,

Before sending debugging log could you please confirm anything do i need to add to my workflow file .

if yes please confirm once & what do i need to add ?

[Subharanjan2055]

Hi @MathiasVP

The following are the logs that says the following :

Finalizing csharp
C:\uat-runner3_work_tool\CodeQL\0.0.0-20221211\x64\codeql\codeql.exe database finalize --finalize-dataset --threads=4 --ram=14703 C:\uat-runner3_work_temp\codeql_databases\csharp
No source code was seen and extracted to C:\uat-runner3_work_temp\codeql_databases\csharp.
This can occur if the specified build commands failed to compile or process any code.

• Confirm that there is some source code for the specified language in the project.
• For codebases written in Go, JavaScript, TypeScript, and Python, do not specify
  an explicit --command.
• For other languages, the --command must specify a "clean" build which compiles
  all the source code files without reusing existing build artefacts.
  Error: No code found during the build. Please see:
  https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning#no-code-found-during-the-build

[Subharanjan2055]

@MathiasVP Any update ?

[MathiasVP]

You shouldn't need to do anything other than enable debugging as specified in https://github.blog/changelog/2022-08-01-debugging-codeql-analysis-in-code-scanning-made-easier-by-obtaining-detailed-logs-and-debugging-artifacts-from-the-codeql-action/. This will leave a zipped debug artifact attached to your GitHub Actions run. If you unzip that you'll find a "build-tracer.log" file in the "logs" directory. That's the magic sauce we need 🙂

The debug information is necessary for us to investigate whether CodeQL is "picking up" on the compiler invocations