Repository navigation
Conversation
…fewest runs check-codeql.yml replaces GitHub's default setup: pull requests to a long-lived branch that are ready for review and touch an analyzable file (paths), plus a weekly scan and a manual run for the baseline; nothing on a push. build-mode none, one job per language, concurrency cancels superseded runs. Declared as a githooks stub and dogfooded here with the python language this repo also uses. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011utfJEcSv7pCD1sxg3ihmL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeQL currently runs through GitHub's default setup (the
CodeQL/Analyze (actions)/Analyze (python)checks), which scans on every push and pull request regardless of what changed. This adds a file-based workflow, declared as agithooksstub and dogfooded, following the workflow configuration options ("Avoiding unnecessary scans of pull requests", "Scanning on a schedule").check-codeql.ymlpull_request(opened,reopened,synchronize,ready_for_review) tomain/developonly, withpathslimited to files CodeQL can analyze (.github/workflows/**,action.yml|yaml;**/*.pyin this repo).pathsdecides whether the workflow runs, not what is analyzed.if); marking ready scans them.pushtrigger. A weeklyschedule(Mon 04:17 UTC) andworkflow_dispatchrefresh the default-branch baseline the PR results are compared with.build-mode: none, one job per language (Analyze (<language>), same check names as the default setup),concurrencycancels superseded runs, 15 min timeout,category: /language:<language>.upload-sarifinvalidate-pr-vulnerabilities.yml.Stub vs dogfood: the stub scans
actionsonly (every consumer has workflows). This repo's copy addspythonto the matrix and**/*.pytopaths. Re-running the stub merge onto the repo copy keeps both (verified withfeature-configureon a scratch repo).Manual step needed — GitHub rejects advanced-configuration analyses while the default setup is on, and both would double the runs: turn off Default setup under Settings → Advanced Security → Code scanning → CodeQL analysis before/when merging. I can't change repository settings from here.
bats tests/(10) passes with the pinned v3 toolchain; prettier is clean.Generated by Claude Code