{"id":66506,"date":"2022-08-15T08:00:07","date_gmt":"2022-08-15T15:00:07","guid":{"rendered":"https:\/\/github.blog\/?p=66506"},"modified":"2022-08-15T09:03:21","modified_gmt":"2022-08-15T16:03:21","slug":"the-next-step-for-lgtm-com-github-code-scanning","status":"publish","type":"post","link":"https:\/\/github.blog\/news-insights\/product-news\/the-next-step-for-lgtm-com-github-code-scanning\/","title":{"rendered":"The next step for LGTM.com: GitHub code scanning!"},"content":{"rendered":"

Three years ago, the team that built LGTM.com joined GitHub<\/a>. From that moment on, we have worked tirelessly to natively integrate its underlying CodeQL analysis technology into GitHub. In 2020, GitHub code scanning was launched<\/a> in public beta, and later that year it became generally available<\/a> for everyone. GitHub code scanning is powered by the very same analysis engine: CodeQL.<\/p>\n

We\u2019ve since continued to invest in CodeQL and GitHub code scanning. Today, GitHub code scanning has all of LGTM.com\u2019s key features\u2014and more<\/a>! The time has therefore come to announce the plan for the gradual deprecation of LGTM.com.<\/p>\n

End of August 2022: no more user sign-ups and new repositories<\/span><\/a><\/h3>\n

Starting at the end of August, LGTM.com will no longer accept new user sign-ups. It will also no longer be possible to add new repositories for analysis to LGTM.com. Existing users will continue to be able to log in and use LGTM.com, and the analysis of existing repositories will continue to work. However, historical analysis<\/a> will no longer be performed\u2013only new commits will be analyzed.<\/p>\n

October: help migrate repositories to GitHub code scanning<\/span><\/a><\/h3>\n

We will do our best to help migrate repositories that actively use LGTM.com to flag potential security issues in their pull requests. For those repositories, we will create pull requests that add a GitHub Actions workflow that runs code scanning<\/a>. Once that configuration file is merged, the repository\u2019s source code (and future pull requests) will be scanned by GitHub code scanning. GitHub code scanning will flag any potential security issues in pull requests<\/a> and on the repository\u2019s security tab<\/a>. Once that\u2019s all working as it should, you can disable the LGTM.com integration.<\/p>\n

Some repositories make use of advanced LGTM.com build and analysis configurations. In such cases, we might not be able to automatically propose a GitHub Actions workflow to set up code scanning. We will notify such repositories directly.<\/p>\n

End of November: new commits and pull requests are no longer analyzed<\/span><\/a><\/h3>\n

At the end of November, LGTM.com will stop fetching new commits for the repositories that it analyzes. It will also stop analyzing pull requests on GitHub.com. Repositories that still use LGTM.com\u2019s pull request analysis in the week(s) leading up to this deprecation phase will be reminded through a message in the pull request comments that are posted by LGTM.com.<\/p>\n

16th of December: LGTM.com will be shut down<\/span><\/a><\/h3>\n

From the 16th of December, LGTM.com will no longer be available. This includes but is not limited to:<\/p>\n