You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "hainenber (via GitHub)" <gi...@apache.org> on 2026/09/26 09:48:11 UTC

[PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

hainenber opened a new pull request, #44699:
URL: https://github.com/apache/superset/pull/44699

   <!---
   Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/
   Example:
   fix(dashboard): load charts correctly
   -->
   feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes
   
   ### SUMMARY
   <!--- Describe the change below, including rationale and design decisions -->
   A very poor-man's way to only run CodeQL analysis when there are JS and/or Python file changes. I reckon this is hard limitation of GHA syntax so it's tough to have a built-in  and cleaner way for conditionally matrixifying workflows.
   
   ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
   <!--- Skip this if not applicable -->
   N/A
   
   ### TESTING INSTRUCTIONS
   <!--- Required! What steps can be taken to manually verify the changes? -->
   Green CI
   
   ### ADDITIONAL INFORMATION
   <!--- Check any relevant boxes with "x" -->
   <!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
   - [ ] Has associated issue:
   - [ ] Required feature flags:
   - [ ] Changes UI
   - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
     - [ ] Migration is atomic, supports rollback & is backwards-compatible
     - [ ] Confirm DB migration upgrade and downgrade tested
     - [ ] Runtime estimates and downtime expectations provided
   - [ ] Introduces new feature or API
   - [ ] Removes existing feature or API
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44699:
URL: https://github.com/apache/superset/pull/44699#issuecomment-5845204291

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4133227534


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -37,6 +35,21 @@ jobs:
         uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Dynamically setup matrix of changed languages
+        id: set-lang-matrix
+        shell: bash
+        run: |
+          lang_matrix_string=''
+          if [[ "${STEPS_CHECK_OUTPUTS_PYTHON}" == "true" ]]; then
+            lang_matrix_string=${lang_matrix_string}'"python"'
+          fi
+          if [[ "${STEPS_CHECK_OUTPUTS_FRONTEND}" == "true" ]]; then
+            lang_matrix_string=${lang_matrix_string}'"javascript"'
+          fi
+          echo "lang_matrix=$(jq --compact-output --null-input '[inputs] | tostring' <<< $lang_matrix_string)"

Review Comment:
   Even after this step is wired up to `$GITHUB_OUTPUT`, the matrix still won't build correctly:
   
   1. `changes.outputs` above only declares `python` and `frontend` — there's no `lang_matrix` entry, so `needs.changes.outputs.lang_matrix` in the `analyze` job stays empty no matter what this step writes.
   2. `jq '[inputs] | tostring'` serializes the array into a JSON string (e.g. `"[\"python\",\"javascript\"]"`), not a bare array. `fromJson(...)` on that value returns a string, not the list `matrix.language` needs.
   
   Could you add `lang_matrix: ${{ steps.set-lang-matrix.outputs.lang_matrix }}` to this job's `outputs:` block and drop `| tostring` so the step emits a plain JSON array?



##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   This narrows CodeQL coverage versus the previous hardcoded matrix: `python`/`frontend` are directory-based change-detector groups, not a language classifier. A change limited to a `.js` file living outside `superset-frontend/` — e.g. `superset/mcp_service/index.js`, or a `.js` file under `scripts/` — sets `python=true` and leaves `frontend=false`, so this matrix will only run the `python` CodeQL analysis and silently skip `javascript`, even though a JavaScript file changed. The old `["python", "javascript"]` matrix always ran both. Is that coverage gap intentional, or should the matrix reflect the actual language of the changed files rather than reusing the `changes`/`frontend` groups?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #44699:
URL: https://github.com/apache/superset/pull/44699#issuecomment-5893385388

   ## [Codecov](https://app.codecov.io/gh/apache/superset/pull/44699?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
   :white_check_mark: All modified and coverable lines are covered by tests.
   :white_check_mark: Project coverage is 56.94%. Comparing base ([`1a65f0e`](https://app.codecov.io/gh/apache/superset/commit/1a65f0ec9be22f4157f9e135254dda0b2a0ef83e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`9783919`](https://app.codecov.io/gh/apache/superset/commit/978391906173f26e2d55eaf8b56b67d3268c7424?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
   :warning: Report is 98 commits behind head on master.
   > :exclamation:  There is a different number of reports uploaded between BASE (1a65f0e) and HEAD (9783919). Click for more details.
   > 
   > <details><summary>HEAD has 49 uploads less than BASE</summary>
   >
   >| Flag | BASE (1a65f0e) | HEAD (9783919) |
   >|------|------|------|
   >|python|44|1|
   >|presto|7|1|
   ></details>
   
   <details><summary>Additional details and impacted files</summary>
   
   
   
   ```diff
   @@             Coverage Diff             @@
   ##           master   #44699       +/-   ##
   ===========================================
   - Coverage   81.12%   56.94%   -24.19%     
   ===========================================
     Files        2956     2966       +10     
     Lines      178436   179789     +1353     
     Branches    41341    41521      +180     
   ===========================================
   - Hits       144764   102382    -42382     
   - Misses      30967    76400    +45433     
   + Partials     2705     1007     -1698     
   ```
   
   | [Flag](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
   |---|---|---|
   | [hive](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [mysql](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [postgres](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [presto](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `38.62% <ø> (-0.07%)` | :arrow_down: |
   | [python](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `38.62% <ø> (-46.79%)` | :arrow_down: |
   | [sqlite](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [unit](https://app.codecov.io/gh/apache/superset/pull/44699/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   
   Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
   </details>
   
   [:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/44699?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).   
   :loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
   <details><summary> :rocket: New features to boost your workflow: </summary>
   
   - :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
   - :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4143878940


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   Oh if that's the case then it's quite a glaring issue with existing `change_detector.py` logic. No doubt that should be fixed but IMO, it's a bit scope-creeping if we include the changes here. I've created https://github.com/apache/superset/issues/44822 for tracking



##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   Created https://github.com/apache/superset/issues/44822 for tracking



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4111684221


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -37,6 +35,18 @@
         uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Dynamically setup matrix of changed languages
+        id: set-lang-matrix
+        shell: bash
+        run: |
+          lang_matrix_string=''
+          if [[ "${{ steps.check.outputs.python }} == "true" ]]; then
+            lang_matrix_string=${lang_matrix_string}'"python"'
+          fi
+          if [[ ${{ steps.check.outputs.frontend }} == "true" ]]; then

Review Comment:
   ## zizmor / 
   
   code injection via template expansion: may expand into attacker-controllable code
   
   [Show more details](https://github.com/apache/superset/security/code-scanning/3901)



##########
.github/workflows/codeql-analysis.yml:
##########
@@ -37,6 +35,18 @@
         uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Dynamically setup matrix of changed languages
+        id: set-lang-matrix
+        shell: bash
+        run: |
+          lang_matrix_string=''
+          if [[ "${{ steps.check.outputs.python }} == "true" ]]; then

Review Comment:
   ## zizmor / 
   
   code injection via template expansion: may expand into attacker-controllable code
   
   [Show more details](https://github.com/apache/superset/security/code-scanning/3900)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4166452145


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   IMO, I think JS changes outside of `superset-frontend` not getting CodeQL scan is at most a status quo and would be improved once said follow-up PR fix it and we won't have to keep in mind to revisit this part again. It's more linear in terms of action items :D



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4135167880


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   >should the matrix reflect the actual language of the changed files rather than reusing the changes/frontend groups?
   
   I agree with this, it's a coverage gap and IMO, should be patched in a follow-up PR.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4166456761


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   This I agree. Let's have back the harness for `all-changes` scheduled trigger.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4111014960


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -66,18 +65,38 @@ jobs:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
+      - name: Initialize CodeQL (python)
+        if: needs.changes.outputs.python == 'true'
         uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
-          languages: ${{ matrix.language }}
+          languages: python

Review Comment:
   **Suggestion:** The matrix creates two jobs, but these hardcoded language steps ignore `matrix.language`, duplicating scans and running both initializations in each job when both change groups are present.
   
   **Assessment:** 🟠 `Major` · 🔁 `Occurrence: Often` · 🏷️ `Performance`
   
   [![Use CodeAnt Skill](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/use-codeant-skill-flat-v2.svg)](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [![Fix in Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=c6d6082106314c678ff7c57d999d2aab&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [![Fix in VSCode Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=c6d6082106314c678ff7c57d999d2aab&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** .github/workflows/codeql-analysis.yml
   **Line:** 68:72
   **Comment:**
   	*Performance: The matrix creates two jobs, but these hardcoded language steps ignore `matrix.language`, duplicating scans and running both initializations in each job when both change groups are present.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=21cb9f470c075c6323842c2865eec78c02c3abb6ffaa1b9f158f619da1a5bc07&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=21cb9f470c075c6323842c2865eec78c02c3abb6ffaa1b9f158f619da1a5bc07&reaction=dislike'>👎</a>



##########
.github/workflows/codeql-analysis.yml:
##########
@@ -66,18 +65,38 @@ jobs:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
+      - name: Initialize CodeQL (python)
+        if: needs.changes.outputs.python == 'true'
         uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
-          languages: ${{ matrix.language }}
+          languages: python
           # If you wish to specify custom queries, you can do so here or in a config file.
           # By default, queries listed here will override any specified in a config file.
           # Prefix the list here with "+" to use these queries and those in the config file.
 
           # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
           # queries: security-extended,security-and-quality
 
-      - name: Perform CodeQL Analysis
+      - name: Initialize CodeQL (javascript)
+        if: needs.changes.outputs.frontend == 'true'
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          languages: javascript
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis (python)
+        if: needs.changes.outputs.python == 'true'
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          category: "/language:python"
+
+      - name: Perform CodeQL Analysis (javascript)
+        if: needs.changes.outputs.python == 'true'
         uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
-          category: "/language:${{matrix.language}}"
+          category: "/language:javascript"

Review Comment:
   **Suggestion:** The JavaScript analysis is gated by `python`, so frontend-only changes initialize JavaScript but never analyze it, while Python-only changes analyze without a JavaScript database.
   
   **Assessment:** 🟠 `Major` · 🔁 `Occurrence: Often` · 🏷️ `Incorrect condition logic`
   
   [![Use CodeAnt Skill](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/use-codeant-skill-flat-v2.svg)](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [![Fix in Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=ae72818f89134f9b820f8e34877923e8&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [![Fix in VSCode Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=ae72818f89134f9b820f8e34877923e8&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** .github/workflows/codeql-analysis.yml
   **Line:** 98:102
   **Comment:**
   	*Incorrect Condition Logic: The JavaScript analysis is gated by `python`, so frontend-only changes initialize JavaScript but never analyze it, while Python-only changes analyze without a JavaScript database.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=9adaefd33d9e4bfafc4293236d803f1f0a3453aa0903c5147161fbe579092f29&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=9adaefd33d9e4bfafc4293236d803f1f0a3453aa0903c5147161fbe579092f29&reaction=dislike'>👎</a>



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4166587652


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   Resolved in 8bd65656f4598e78abe0c1fb82d19d76df6c2669



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4111684419


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -66,18 +65,38 @@ jobs:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
+      - name: Initialize CodeQL (python)
+        if: needs.changes.outputs.python == 'true'
         uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
-          languages: ${{ matrix.language }}
+          languages: python

Review Comment:
   ✅ **CodeAnt verified this suggestion was addressed in subsequent commits and marked this thread resolved** as of `9c88534`.
   
   CodeQL initialization now uses `matrix.language`, so each matrix job scans only its assigned language. The analysis category also uses the same matrix value.
   
   <sub>If that's not right, unresolve this thread and CodeAnt will leave it open.</sub>
   
   <!-- codeant-auto-resolve-reply -->



##########
.github/workflows/codeql-analysis.yml:
##########
@@ -66,18 +65,38 @@ jobs:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
+      - name: Initialize CodeQL (python)
+        if: needs.changes.outputs.python == 'true'
         uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
-          languages: ${{ matrix.language }}
+          languages: python
           # If you wish to specify custom queries, you can do so here or in a config file.
           # By default, queries listed here will override any specified in a config file.
           # Prefix the list here with "+" to use these queries and those in the config file.
 
           # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
           # queries: security-extended,security-and-quality
 
-      - name: Perform CodeQL Analysis
+      - name: Initialize CodeQL (javascript)
+        if: needs.changes.outputs.frontend == 'true'
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          languages: javascript
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          # queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis (python)
+        if: needs.changes.outputs.python == 'true'
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          category: "/language:python"
+
+      - name: Perform CodeQL Analysis (javascript)
+        if: needs.changes.outputs.python == 'true'
         uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
-          category: "/language:${{matrix.language}}"
+          category: "/language:javascript"

Review Comment:
   ✅ **CodeAnt verified this suggestion was addressed in subsequent commits and marked this thread resolved** as of `9c88534`.
   
   The language-specific Python condition is gone. Initialization and analysis now run per `matrix.language`, allowing JavaScript and Python changes to be analyzed independently.
   
   <sub>If that's not right, unresolve this thread and CodeAnt will leave it open.</sub>
   
   <!-- codeant-auto-resolve-reply -->



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on PR #44699:
URL: https://github.com/apache/superset/pull/44699#issuecomment-5895490648

   > Could you fix that and test against a branch that actually changes python or JS files, so we know the matrix comes out right before this lands?
   
   I made a placeholder change in a Python test file and you can see the CodeQL analysis ran **only** for Python lang :D
   
   <img width="1117" height="539" alt="image" src="https://github.com/user-attachments/assets/7cc1acb8-e130-4d7f-a3ef-2fbb1b6ebfd2" />
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4174080090


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   Incorporated in https://github.com/apache/superset/pull/44699/commits/770b157ffc9cc8e61b49ea38490d31c0b137bf0b



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4171530105


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   The base workflow runs both languages when a `superset/` or `scripts/` file changes, whereas this matrix runs only Python for a JavaScript file in either directory. Restoring the daily full scan helps after merge but still removes that JavaScript check from the PR; could this keep both languages until the language-aware detector is wired in?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #44699:
URL: https://github.com/apache/superset/pull/44699#issuecomment-5883836285

   Thanks for tackling this, @hainenber! One thing before this can merge, though.
   
   Looks like `set-lang-matrix` builds the `lang_matrix` string but never writes it to `$GITHUB_OUTPUT`, just echoes it to the log. So `needs.changes.outputs.lang_matrix` will come through empty, and `fromJson()` on that in `analyze`'s matrix is going to blow up the first time a PR actually touches python or JS. This PR's own CI didn't catch it since it only touches workflow yaml, so `analyze` never ran to exercise that path. Could you fix that and test against a branch that actually changes python or JS files, so we know the matrix comes out right before this lands?
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44699:
URL: https://github.com/apache/superset/pull/44699#issuecomment-5896118803

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
   
   <details>
   <summary>
   Bito Usage Guide
   </summary>
   
   **Commands**
         
   Type the following command in the pull request comment and save the comment.
         
   - `/review` - Manually triggers an incremental AI Review.
   - `/review full` - Manually triggers a full AI Review.
   
   - `/pause` - Pauses automatic reviews on this pull request.
   - `/resume` - Resumes automatic reviews.
   - `/resolve` - Marks all Bito-posted review comments as resolved.
   - `/abort` - Cancels all in-progress reviews.
   
         
   Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
         
   **Configuration**
   
   This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
         
   **Documentation & Help**
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
   
   </details>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber merged PR #44699:
URL: https://github.com/apache/superset/pull/44699


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4173512914


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   The merged detector adds a separate `languages` output, but this head still builds the matrix from `python`/`frontend`, so rebasing alone would still skip JavaScript outside the frontend directory. Could you incorporate the detector change and wire its `languages` output into both matrix selection and the analysis gate?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #44699:
URL: https://github.com/apache/superset/pull/44699#issuecomment-5893223375

   ### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
   
   
   |  Name | Link |
   |:-:|------------------------|
   |<span aria-hidden="true">🔨</span> Latest commit | 6e97cf1d0a3ed5212dcf25870c07ff0189832b5c |
   |<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6abbd6e9171a82000833fa68 |
   |<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-44699--superset-docs-preview.netlify.app](https://deploy-preview-44699--superset-docs-preview.netlify.app) |
   |<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTQ0Njk5LS1zdXBlcnNldC1kb2NzLXByZXZpZXcubmV0bGlmeS5hcHAifQ.i9IEWrErZ3FPvpCFQflS8vRLC6nN_059Hb-F55A4HiU)<br /><br />_Use your smartphone camera to open QR code link._</details> |
   |<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DcwxDsMgDEDRu3iuFdJIhPYGPYbBTopEMSVkQFHvXravP7wLStVPafAEuIGvlMN79CbUpqCZY4uaKaWO9cwYlOWbkMbpRzywSEWWJqEJY6K8n7TLcFhK0v7iIVnynq085nUmdzfGuGXZyDr4_QE) |
   ---
   <!-- [superset-docs-preview Preview](https://deploy-preview-44699--superset-docs-preview.netlify.app) -->
   _To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4136517284


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -37,6 +35,21 @@ jobs:
         uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Dynamically setup matrix of changed languages
+        id: set-lang-matrix
+        shell: bash
+        run: |
+          lang_matrix_string=''
+          if [[ "${STEPS_CHECK_OUTPUTS_PYTHON}" == "true" ]]; then
+            lang_matrix_string=${lang_matrix_string}'"python"'
+          fi
+          if [[ "${STEPS_CHECK_OUTPUTS_FRONTEND}" == "true" ]]; then
+            lang_matrix_string=${lang_matrix_string}'"javascript"'
+          fi
+          echo "lang_matrix=$(jq --compact-output --null-input '[inputs] | tostring' <<< $lang_matrix_string)"

Review Comment:
   Good catch! Fixed in https://github.com/apache/superset/pull/44699/commits/978391906173f26e2d55eaf8b56b67d3268c7424



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4139973247


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   On a push containing multiple commits, the change detector only compares the final commit with its parent, so a Python change earlier in the push can be omitted when the tip only changes frontend code; this matrix then skips the Python scan, and the removed schedule no longer catches it later. Could this derive changed files from the push's full before-to-after range instead?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4154471551


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   Tracking this in a follow-up still leaves JavaScript changes outside `superset-frontend/` without a JavaScript scan after this merges. Could we keep both languages in the matrix until the detector can classify those files correctly?



##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   The detector bug predates this PR, but using its output to drop a language scan and removing the scheduled fallback makes it a coverage regression here. Could we retain the full language matrix or the scheduled full scan until the push-range fix lands?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] feat(ci): conditionally run CodeQL analysis workflows only when there are detected JS/Python file changes [superset]

Posted by "hainenber (via GitHub)" <gi...@apache.org>.
hainenber commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4171671249


##########
.github/workflows/codeql-analysis.yml:
##########
@@ -56,7 +69,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["python", "javascript"]
+        language: ${{ fromJson(needs.changes.outputs.lang_matrix) }}

Review Comment:
   Since we have lang-classifying detector fix merged in, we can proceed now. I'll need to incorporate it though



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org