ci: add CodeQL advanced setup to scan main and develop#220
Merged
Conversation
Switches from GitHub default setup to an advanced setup workflow so that CodeQL also scans the develop branch. Default setup cannot be configured to watch a second branch (GitHub returns 422 when an extra branch is requested via the API). The committed workflow covers the same scope that default setup provided (languages: actions, python; query suite: default; weekly schedule on Monday 02:00 UTC) and extends it to push and pull requests targeting both main and develop. autobuild is omitted: Python and actions (YAML) are interpreted or declarative languages that do not require a compilation step. CodeQL indexes them directly. Action versions: actions/checkout@v4 (matches existing repo workflows), github/codeql-action@v4 (current stable major; v3 is a maintenance track). Note: GitHub enforces mutual exclusivity between default setup and advanced setup. Merging this workflow to the default branch (main) and letting it run will disable default setup automatically. A reviewer should treat this PR as a full replacement, not an addition. GOSS-GridAPPS-D is intentionally left on default setup as authorized.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches gridappsd-python from GitHub's default CodeQL setup to an advanced setup (a committed
.github/workflows/codeql.yml). The sole motivation is branch coverage: default setup scans only the default branch (main) and pull requests into it. It cannot be extended to also scan develop via the API (GitHub returns 422). The advanced setup workflow adds push and PR triggers for both main and develop while keeping everything else identical to what default setup was running.What changes
.github/workflows/codeql.yml(one file, no other repo changes).actionsandpython, matching what default setup currently scans (verified via the code-scanning API before authoring).default, matching default setup.actions/checkout@v4(consistent with existing repo workflows),github/codeql-action@v4(current stable major).autobuildis omitted: Python and actions (YAML) are interpreted/declarative and require no build step. CodeQL indexes them directly.Tradeoff to review
Merging this PR disables default setup. GitHub enforces mutual exclusivity: once this workflow runs on main, default setup is deactivated automatically. This PR is a full replacement, not an addition. If the workflow under-scans (wrong languages, wrong branches), we will have traded a working scan for a broken one. The workflow was authored to match the default setup configuration exactly, plus the develop extension.
GOSS-GridAPPS-D is intentionally left on default setup and was not touched.
No secrets required
CodeQL uses the built-in
GITHUB_TOKENviasecurity-events: write. No additional secrets or configuration needed.