apache / apache/cloudstack

Use separate CodeQL workflow files for each language

Open
#11,655 1 comment 0 reactions 0 assignees View on GitHub
component:github-actions long-term-plan status:Help-wanted
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

Discussion below:

> Do we need to add more languages here?

Let us get this PR merged first before we add more languages and checks.

For example if we add the Java language to the matrix we may also need to implement "paths" or only run the Java CodeQL check when certain files change. These checks can sometimes take a while to run on the CI.

Also it is probably best to separate each language that we want to check into its own CodeQL workflow file and add all the "paths". For example:

- java-codeql-analysis.yml
- python-codeql-analysis.yml
- actions-codeql-analysis.yml
- etc

Using separate CodeQL workflow files for each language in a multi-language repository allows for tailored analysis and build processes. This approach is particularly useful when languages have different build requirements or when you want to apply specific queries or configurations to individual languages.

Our current analysis file:

https://github.com/apache/cloudstack/blob/main/.github/workflows/codeql-analysis.yml

_Originally posted by @jbampton in https://github.com/apache/cloudstack/pull/11300#discussion_r2352998006_

Contributor guide

Open the contributing guide

Research direction

Start with .github/workflows/codeql-analysis.yml and the discussion from pull request 11300. Identify the languages currently covered and the file paths that should trigger each check. Done means each language has its own CodeQL workflow file with appropriate paths and language-specific configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, java, python
Domain
ci-cd, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.