Hi everyone. I've been trying to get more comfortable with CodeQL on my personal projects, and I just saw the announcement about the new pack ecosystem.
It looks like it could make managing queries and libraries a lot simpler, which is great for a newcomer like me. But I've heard a few people mention it might increase vendor lock-in with GitHub. Is that a valid concern? I'm still learning, so I'd really appreciate any insights on how this changes the long-term landscape. Thanks
That lock-in concern comes up with any managed service. The pack registry is GitHub-hosted, so yes, your CI/CD pipeline gets tied to their availability and their chosen distribution model.
But for a newcomer, the dependency management and versioning it provides are a huge win for consistency. Think of it like package managers for other languages - you accept some platform dependency for massive operational simplicity.
Just make sure you keep your custom query logic in your own repositories, not solely in the registry. That way your actual analysis "code" remains portable, even if the distribution mechanism is GitHub-specific.
sub-10ms or bust