Add CodeQL config file to only run the scan for production code#1680
Add CodeQL config file to only run the scan for production code#1680anupsdf wants to merge 2 commits into
Conversation
| pull_request: | ||
| branches: [main] | ||
| schedule: | ||
| - cron: "0 6 * * 1" |
There was a problem hiding this comment.
Runs at 6:00 every Monday.
There was a problem hiding this comment.
Pull request overview
Adds a GitHub CodeQL workflow and configuration intended to reduce noise by limiting scanning to “production” Rust source directories (excluding tests/benches/fuzz/etc.).
Changes:
- Introduces a new
.github/workflows/codeql.ymlCodeQL workflow for Rust and Actions. - Adds
.github/codeql/codeql-config.ymlto restrict CodeQL scanning to selected cratesrcdirectories and ignore non-production paths.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
.github/workflows/codeql.yml |
New CodeQL workflow that initializes and runs CodeQL analysis, with a manual Rust build step and a shared config file. |
.github/codeql/codeql-config.yml |
CodeQL configuration limiting scanned paths to specific Rust crate src directories and ignoring non-production directories. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| paths: | ||
| - soroban-builtin-sdk-macros/src | ||
| - soroban-env-common/src | ||
| - soroban-env-guest/src | ||
| - soroban-env-host/src | ||
| - soroban-env-macros/src | ||
| - soroban-simulation/src | ||
| - soroban-synth-wasm/src | ||
| - soroban-test-wasms/src |
There was a problem hiding this comment.
The workflow matrix includes language: actions, but the referenced CodeQL config-file restricts paths to Rust crate */src directories only. That likely excludes .github/workflows/**, so the Actions CodeQL run may analyze zero files. Consider either adding .github/workflows (or .github) to paths, or splitting per-language configs / removing the actions language entry.
| on: | ||
| pull_request: | ||
| branches: [main] | ||
| schedule: | ||
| - cron: "0 6 * * 1" |
There was a problem hiding this comment.
This workflow only runs on push to main and on a schedule. If you want CodeQL results to show up on pull requests before merge (as the Rust CI does), add a pull_request (and possibly merge_group) trigger.
|
|
||
| - name: Build (Rust) | ||
| if: matrix.language == 'rust' | ||
| run: cargo build --workspace --all-features |
There was a problem hiding this comment.
For consistency with the repo’s CI (e.g., .github/workflows/rust.yml uses --locked), consider running the CodeQL build step with cargo build --locked ... so the analysis fails if Cargo.lock is out of date instead of silently updating dependencies.
| run: cargo build --workspace --all-features | |
| run: cargo build --locked --workspace --all-features |
Pull request was converted to draft
|
https://github.com/stellar/rs-soroban-env/actions/runs/24580520681/job/71876873614?pr=1680 is failing because default setup needs to be removed for advanced setup to run: Go to |
| name: "CodeQL" | ||
|
|
||
| on: | ||
| pull_request: |
There was a problem hiding this comment.
This is for testing if the job runs. Final version will just have a cron job.
Looks like I don't have permissions to |
What
Add CodeQL config file to only run the scan for production code
Why
Current CodeQL scan has tagged a lot of test files that we can ignore