(ofbiz-framework) 01/04: Run the CodeQL analysis only when it is useful

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git

commit 60aaa0878bdb4c1ddb29869bf12c96c014eee9bb
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Thu Oct 22 10:53:05 2026 +0200

    Run the CodeQL analysis only when it is useful
    
    The ubuntu-latest runners are a limited resource shared by all the ASF
    projects, so avoid using them when the analysis cannot be affected:
    
    - trigger the workflow only for changes that can affect the analyzed
      sources, with the same paths filter as the Java CI workflow:
      changes to documentation, Windows scripts, legal/info files,
      Docker/IDE/devcontainer setup and other workflows no longer start
      an analysis; the weekly scheduled analysis runs anyway
    - cancel the analysis of a pull request that is still running or
      queued when a new commit is pushed to it; analyses of pushes to
      trunk and release* branches are never cancelled, and each of them
      gets its own concurrency group
    - skip the analysis of Dependabot pull requests, which only change
      dependency versions; the push of their merge is analyzed as any
      other push
    
    Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
    
    (cherry picked from commit ca023e763acf95b9a592e427e5ad69d50461aa95)
---
 .github/workflows/codeql-analysis.yml | 42 +++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 0ebd1d2942..a4ad6f31dc 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -20,18 +20,60 @@ name: "CodeQL"
 on:
   push:
     branches: [ trunk, release* ]
+    # Changes that cannot affect the analyzed sources (documentation, Docker/IDE/devcontainer
+    # setup, Windows-only scripts, other workflows...) don't trigger the analysis: the
+    # ubuntu-latest runners are a limited resource shared by all the ASF projects.
+    # The weekly scheduled analysis runs anyway.
+    # GitHub evaluates these patterns in order, so a later pattern can re-include a path that an
+    # earlier "!" pattern excluded.
+    paths: &analysis-paths
+      - '**'
+      - '!**.md'
+      - '!**.adoc'
+      - '!**/src/docs/**'
+      - '!docs/**'
+      - '!**.bat'
+      - '!APACHE2_HEADER'
+      - '!INSTALL'
+      - '!LICENSE'
+      - '!NOTICE'
+      - '!OPTIONAL_LIBRARIES'
+      - '!VERSION'
+      - '!.asf.yaml'
+      - '!.devcontainer/**'
+      - '!.dockerignore'
+      - '!.gitattributes'
+      - '!.gitignore'
+      - '!.hgignore'
+      - '!.idea/**'
+      - '!.pre-commit-config.yaml'
+      - '!Dockerfile'
+      - '!docker/**'
+      - '!.github/**'
+      - '.github/workflows/codeql-analysis.yml'
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [ trunk, release* ]
+    paths: *analysis-paths
   schedule:
     - cron: '27 15 * * 1'
 
+# A new push to a pull request makes its previous, still running or queued analysis useless.
+# Pushes to trunk and release* are never cancelled so that every commit gets its own result.
+# Each of them gets its own group (run_id): in a shared group a newer run would replace a pending one.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
 jobs:
   analyze:
     name: Analyze
+    # A Dependabot pull request only changes dependency versions, not the analyzed sources.
+    # The push of its merge is analyzed as any other push.
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       actions: read