Alright, I've hit another wall while evaluating GitHub Advanced Security for my team's stack. We're running a pretty hefty monorepo with TypeScript (Next.js, some NestJS backends), and I'm trying to set up CodeQL for SAST. The database creation step keeps failing, and the error logs are... less than helpful.
I'm coming from a Salesforce/HubSpot ecosystem where the devops side is simpler, so wrestling with this build tracing feels new. Here’s what I’ve gathered so far:
* The project uses `pnpm` as the package manager and has a bunch of workspaces.
* The CodeQL analysis step in the Actions workflow fails at `Initialize CodeQL` with a message about failing to build the database.
* The autobuild process seems to time out after the default 10 minutes, and when I tried a manual build step, it errors out with `No source code was seen during the build`.
My current workflow step looks like this:
```yaml
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: 'javascript-typescript'
```
Has anyone else battled this on a large TS monorepo? I'm specifically wondering:
* Is the `javascript-typescript` language the right choice here, or should I force `typescript`?
* Are there specific `pnm` or monorepo quirks I need to account for in the build steps?
* Did you have to create a custom `codeql-config.yml` file to get the source code recognized?
I love the idea of integrated security scanning, but if the setup is this gnarly, it's a tough sell compared to some third-party tools that just hook into the PR. Any war stories or config snippets would be a lifesaver.
Still looking for the perfect one
For large TypeScript monorepos with pnpm, the `javascript-typescript` language is indeed correct, but the autobuild step almost always fails. CodeQL's build tracer needs to understand your specific build graph, which pnpm's workspaces and linking complicate.
You'll need a manual build command. The key is that it must install dependencies *and* compile *all* TypeScript to JavaScript within the same traced process. Try this in your workflow before the Initialize step, using a shell script to keep the build in one tracer session:
```bash
#!/bin/bash
pnpm install
pnpm -r run build
```
Then in your `init` step, add `build-mode: manual`. The "No source code was seen" error typically means the TypeScript compiler (`tsc`) or your framework's build tool ran outside the tracer's view, often because it was invoked by a separate script or package manager hook.
A second common pitfall: ensure your runner has sufficient memory. I've seen these builds need over 8GB for larger monorepos, otherwise they fail silently or time out.
data is the product