Is it possible to re-run the tool and update code scanning workflow files?

[charliew33]

I planning on using the tool to roll out GHAS Code Scanning to hundreds of repos, with a customized workflow file per language. I'm wondering if the tool is capable of being run again in the future and overwriting any existing scanning workflows if we need to change configuration?

[NickLiffen]

Right now no, but I think that sounds like a good idea 👀 We could likely get something working for you if needed. Just a quick question, is there a reason why default setup doesn't work for you now? That should hopefully be easier to use then running this and adding workflows? 😄

[charliew33]

Thanks, yeah that would be super useful. The default setup works on some languages, but most compiled repos I'm running require some manual configuration since autobuild fails.

[NickLiffen]

That makes so much sense 🙇 Random question, is your complied repos mainly Java? 👀

[charliew33]

Yep. Maven builds requiring configuration to hook into private dependency management. C++ autobuild also failing but less of a concern.

[charliew33]

Would be super useful if autobuild were more configurable..

[john-yacuta-submittable]

Is there any update on this @NickLiffen? I also was thinking about this use case. I opened a discussion on a similar topic: https://github.com/orgs/community/discussions/129912

Use case: I have outdated codeql-actions@v2 in the codeql-analysis files generated by this repos /bin/workflows folder that need to be updated to v3 per the deprecation notice: https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/

Main question: If I update the codeql-actions versions in alls files under /bin/workflows, does the tool support being re-run and patching the existing code scanning workflow files?