Remove csharp from CodeQL analysis — only scan C/C++#564
Remove csharp from CodeQL analysis — only scan C/C++#564
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a repository-owned CodeQL workflow intended to avoid failing C# analysis by scoping CodeQL to a single language matrix entry.
Changes:
- Add
.github/workflows/codeql.ymlto run CodeQL on pushes/PRs tostaging/mainand on a weekly schedule. - Configure CodeQL initialization to use a matrix with
c-cppandautobuildmode.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - language: c-cpp | ||
| build-mode: autobuild |
There was a problem hiding this comment.
This workflow is configured to analyze only c-cpp, but the repo appears to contain no C/C++ source files (no .c/.cc/.cpp/.h/.hpp found). That means CodeQL will either produce no useful results or the autobuild step may fail due to no detectable build. If the goal is to avoid failing on C# fixtures while still scanning this repo’s code, consider switching matrix.language to the actual implementation languages here (e.g., python and javascript-typescript) rather than c-cpp.
| - language: c-cpp | |
| build-mode: autobuild | |
| - language: python | |
| build-mode: autobuild | |
| - language: javascript-typescript | |
| build-mode: autobuild |
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| build-mode: ${{ matrix.build-mode }} | ||
|
|
||
| - if: matrix.build-mode == 'autobuild' | ||
| name: Autobuild | ||
| uses: github/codeql-action/autobuild@v3 | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 | ||
| with: | ||
| category: "/language:${{matrix.language}}" |
There was a problem hiding this comment.
steps: list items are not indented under the steps: key (e.g., - name: Checkout repository is aligned with steps:). This is invalid YAML and will cause the workflow to fail to load. Indent all step entries (and their nested keys) so the - name lines are children of steps:.
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| - if: matrix.build-mode == 'autobuild' | |
| name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| - if: matrix.build-mode == 'autobuild' | |
| name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" |
The dynamic CodeQL workflow was attempting to analyze C# code that exists solely as test code and cannot be auto-built, causing the CodeQL job to fail.
Changes
.github/workflows/codeql.yml— custom CodeQL workflow that overrides the dynamic GitHub-managed setup, scoping analysis exclusively toc-cppand droppingcsharpUses
codeql-actionv3 with matrix strategy, runs on push/PR tostaging/mainand weekly schedule.Original prompt
Update the CodeQL workflow at dynamic/github-code-scanning/codeql to remove csharp from the languages list in the CodeQL initialization step. Use:
uses: github/codeql-action/init@v2
with:
languages: c, cpp
This change ensures CodeQL will only analyze C and C++ code, skipping C# analysis and avoiding build errors related to C# test code.
The following is the prior conversation context from the user's chat exploration (may be truncated):
User: Please find a solution for this failing job. Use the logs, job definition, and any referenced files where the failure occurred. Keep your response focused on the solution and include code suggestions when appropriate.
Assistant: The failing CodeQL job could not auto-detect a suitable build method for C#. The error in the logs is:
This means the CodeQL workflow uses the default autobuild step, but your repository's build process is not automatically detected.
Solution
Update the workflow file (
dynamic/github-code-scanning/codeql) to use manual build steps.Replace:
With explicit build steps for your C# code. For example, if you use
dotnet build:Make sure the build command matches your project structure and dependencies.
Code Example (workflow snippet)
Summary
Replace the autobuild action with manual build steps that fit your repository. This will resolve the detection error and allow CodeQL to analyze your code correctly.
Let me know your exact build commands if you need further help updating the workflow file.
User: but these code are just for tests not really needed to be build
Assistant: If the C# code is only for tests and not required for builds, you can do one of the following:
1. Skip C# Analysis in CodeQL Job
Update your CodeQL workflow to only analyze the relevant languages (such as C or C++), and remove C# from the
languageslist.Example:
This will prevent CodeQL from trying to build C# code.
2. Exclude Test Directories from CodeQL
If you still need to analyze C# but want to skip test files, use the
pathsandpaths-ignoreoptions in your workflow.Example:
This skips files and directories matching
test/.3. Remove Unnecessary Build Steps
If there’s no C# code required, ensure you do not run C# autobuild or build steps in the workflow.
Summary
languageslist if not needed.paths-ignoreto skip test code.Let me know which workflow option you'd prefer, or share your workflow file for targeted suggestions!
User: please prepare a PR
Assistant: To prepare a PR that fixes the failing CodeQL job, I need to know which solution you'd like to implement:
paths-ignorePlease confirm your preferred solution, or share your workflow requirements. Once you confirm, I’ll prepare the PR in FalkorDB/code-graph for you.
User: can we just do the skip?
uses: github/codeql-action/init@v2
with:
languages: csharp
paths-ignore: |
test/
Assistant: Yes, you can simply use the skip option by adding
paths-ignore: test/to your CodeQL initialization step. This will instruct CodeQL to ignore thetest/directory, so it won’t attempt to analyze or build code in your test files, resolving the build issue for C# test code.PR Plan
dynamic/github-code-scanning/codeqlin FalkorDB/code-graph.paths-ignore: test/to theInitialize CodeQLstep.Example snippet:
If you'd like, I can ...
This pull request was created from Copilot chat.
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.