ci: switch CodeQL to advanced setup for re-run support - #714
Conversation
lizhengfeng101
changed the title
|
🔍 OpenCodeReview found 4 issue(s) in this PR.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: false |
There was a problem hiding this comment.
[performance · low]
cancel-in-progress: false means that when multiple pushes happen in quick succession to the same branch, superseded runs will continue to completion and consume runner resources even though their results are outdated. For a code scanning workflow like CodeQL, setting cancel-in-progress: true is generally preferred to free up runners for the latest analysis.
Suggestion:
| cancel-in-progress: false | |
| cancel-in-progress: true |
| # - https://gh.io/supported-runners-and-hardware-resources | ||
| # - https://gh.io/using-larger-runners (GitHub.com only) | ||
| # Consider using larger runners or machines with greater resources for possible analysis time improvements. | ||
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} |
There was a problem hiding this comment.
[performance · medium]
The analyze job does not specify timeout-minutes. CodeQL analysis can occasionally hang or take excessively long (especially during autobuild for Go), and without an explicit timeout the job could run up to GitHub's default limit (6 hours for public repos). Adding a reasonable timeout (e.g., 60–120 minutes) will prevent hung jobs from wasting runner resources.
Suggestion:
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} | |
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} | |
| timeout-minutes: 120 |
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
[other · high]
actions/checkout@v7 is referenced here. As of the latest widely known releases, v4 is the current major version of actions/checkout. Please verify that v7 is a valid and published release — using a non-existent version tag will cause the workflow to fail at runtime. If v7 does not exist, use actions/checkout@v4 instead.
Suggestion:
| uses: actions/checkout@v7 | |
| uses: actions/checkout@v4 |
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
[other · low]
Upon further review, I see this is consistent with other workflows in the repository (e.g., ci.yml also uses actions/checkout@v7). No issue here — the version is consistent across the project.
2 participants
Description
Switch CodeQL from default setup to advanced (self-managed workflow) to:
cancel-in-progress: false)Type of Change
Checklist