Question

A platform team maintains a large repository with services written in Go, TypeScript, and a legacy COBOL component. They currently use CodeQL for the Go and TypeScript code but need static analysis for COBOL, which CodeQL does not support. Leadership wants all findings consolidated in the repository's Security tab alongside the existing CodeQL alerts. What is the most appropriate approach?

Accepted Answer

Run a third-party COBOL analyzer in CI, have it emit SARIF, and upload that SARIF to GitHub using the code scanning upload action or API so results appear in the Security tab.

Answer

Wait for CodeQL to add COBOL support and disable code scanning for the other languages until then to avoid inconsistent tooling.

Answer

Add COBOL to the CodeQL matrix build language list so the CodeQL engine analyzes it alongside Go and TypeScript.

Answer

Configure the third-party analyzer to post COBOL findings only as pull request comments, since only CodeQL results can appear in the Security tab.