[C#] General issue: CodeQL scanner encounters issues without reporting them

[EinarSnorrason]

Description of the issue

I set up CodeQL scanning using default configurations in a private repository. When scanning the C# code, it reports that it had a low quality scan due to issues, and recommends resolving those issues. However, when I check the status page there are no other issues reported.

Looking at the actions logs reveals the same situation:

 CodeQL scanned 630 out of 630 C# files in this invocation. Check the status page for overall coverage information: https://github.com/**********/********/security/code-scanning/tools/CodeQL/status/
Analysis produced the following diagnostic information:
##[group]C# analysis with build-mode 'none' completed (1 result)
* C# analysis with build-mode 'none' completed.
##[endgroup]
##[group]Low C# analysis quality (1 result)
* Scanning C# code completed successfully, but the scan encountered issues. This may be caused by problems identifying dependencies or use of generated source code, among other reasons -- see other CodeQL diagnostics reported on the CodeQL status page for more details of possible causes. Addressing these warnings is advisable to avoid false-positive or missing results. If they cannot be addressed, consider scanning C# using either the `autobuild` or `manual` [build modes](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#comparison-of-the-build-modes).
##[endgroup]
##[group]C# was extracted with build-mode set to 'none' (1 result)
* C# was extracted with build-mode set to 'none'. This means that all C# source in the working directory will be scanned, with build tools, such as NuGet and dotnet CLIs, only contributing information about external dependencies.
##[endgroup]
 
##[group]Uploading code scanning results

There doesn't seem to be any information in the output showing what the issues it encountered were or how to fix them.

[redsun82]

👋 @EinarSnorrason

After doing a bit of investigation, it does seem like the messaging there can be confusing, and I apologize for that.

That message is fired by this query. In particular this means that analysis wasn't able to resolve 95% or more of call targets or expression types in your code, which may impact the quality of analysis.

What the message should state, is that this situation may be accompanied by other diagnostics that could point to a root cause, but the problem might be something that we weren't able to detect and raise a diagnostic for. We will definitely consider improving the messaging there.

As the message states, you could try switching to Advanced setup and use autobuild build mode, and if that fails switching to manual. More information about build modes can be found in the docs.

[EinarSnorrason]

That makes sense. Just wanted to make sure there wasn't some issue that wasn't being reported. Thanks for the reply!