Repository navigation
ci: scan Rust with CodeQL only when a PR touches it - #423
Merged
Merged
Conversation
Rust takes about 5.5 minutes in CodeQL, nearly all of it extraction and queries over the whole crate, with no cache to use. 25 of the last 60 PRs touched nothing under crates/ or Cargo.*, and still waited for it. Default setup cannot filter by path, so this moves to workflows of our own. Rust runs on PRs that touch it, the other languages skip docs-only PRs, and a new push to a PR cancels the scan of the last one. Pushes to dev and main and the weekly run still scan everything. The categories match default setup's so alerts carry over. Default setup has to be turned off before these can upload. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Analyze (rust)takes about 5.5 minutes (median of the last 14 PR runs), and it ran even on docs-only PRs. Extraction took 102 s, import 33 s and queries 158 s on #420, and nothing is cached between runs. It does not block merging, but it is the last check to finish.crates/,Cargo.tomlorCargo.lock. 25 of the last 60 merged PRs touched none of these.devandmainand the weekly run still scan everything, with the same languages and default query suite. A PR that changes Rust still takes about 5.5 minutes.Before merging: default setup has to be turned off in Settings > Advanced Security, because code scanning rejects these uploads while it is on. Until then, the
Analyzechecks on this PR are expected to fail. They are not required checks, so re-run them after turning it off.Categories match default setup's, so alerts should carry over. Check that the one open alert is still open after the first run on
dev.Tested:
actionlintis clean. The workflows have not run on GitHub yet.🤖 Generated with Claude Code