You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/03 16:52:18 UTC
(superset) branch ci/codeql-job-level-gating created (now c3ea9079822)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch ci/codeql-job-level-gating
in repository https://gitbox.apache.org/repos/asf/superset.git
at c3ea9079822 ci: gate CodeQL analysis at the job level for docs-only PRs
This branch includes the following new commits:
new c3ea9079822 ci: gate CodeQL analysis at the job level for docs-only PRs
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: ci: gate CodeQL analysis at the job level for docs-only PRs
Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch ci/codeql-job-level-gating
in repository https://gitbox.apache.org/repos/asf/superset.git
commit c3ea9079822c005541e23ff6b838726829415d72
Author: Claude Code <no...@anthropic.com>
AuthorDate: Wed Jun 3 09:51:55 2026 -0700
ci: gate CodeQL analysis at the job level for docs-only PRs
CodeQL gated only its final analyze step on the change-detector, so on a
docs-only PR both language runners (python, javascript) still spun up,
checked out, ran the detector, and initialized CodeQL before skipping the
analysis. Move the gate to the job level via the shared `changes` job so
those runners don't start at all when no code changed.
A job-level skip is deliberately used instead of a `paths-ignore` filter:
a skipped required check is treated as passing by branch protection,
whereas a path-filtered workflow never reports its check and would block
merges if CodeQL is required. push and scheduled runs are unaffected (the
detector returns "all changed" for non-PR events).
Co-Authored-By: Claude Opus 4.8 <no...@anthropic.com>
---
.github/workflows/codeql-analysis.yml | 31 ++++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 58121e3a581..1963630c022 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -15,8 +15,32 @@ concurrency:
cancel-in-progress: true
jobs:
+ changes:
+ runs-on: ubuntu-24.04
+ permissions:
+ contents: read
+ pull-requests: read
+ outputs:
+ python: ${{ steps.check.outputs.python }}
+ frontend: ${{ steps.check.outputs.frontend }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+ with:
+ persist-credentials: false
+ - name: Check for file changes
+ id: check
+ uses: ./.github/actions/change-detector/
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+
analyze:
name: Analyze
+ needs: changes
+ # Skip on PRs that touch neither code group (e.g. docs-only) so the
+ # analysis runners don't spin up. push/schedule runs always proceed:
+ # the change-detector returns "all changed" for non-PR events.
+ if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'
runs-on: ubuntu-24.04
permissions:
actions: read
@@ -35,12 +59,6 @@ jobs:
with:
persist-credentials: false
- - name: Check for file changes
- id: check
- uses: ./.github/actions/change-detector/
- with:
- token: ${{ secrets.GITHUB_TOKEN }}
-
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
@@ -54,7 +72,6 @@ jobs:
# queries: security-extended,security-and-quality
- name: Perform CodeQL Analysis
- if: steps.check.outputs.python || steps.check.outputs.frontend
uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
with:
category: "/language:${{matrix.language}}"