Skip to content

Run CodeQL only post merge #4385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
runningcode merged 3 commits into from
May 13, 2025
Merged

Run CodeQL only post merge #4385

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0368b54
[DNM] Test CodeQL
runningcode May 9, 2025
91a8bcb
Don't run codeql on pull request builds
runningcode May 12, 2025
a26f04d
Merge branch 'main' into no/codeql
runningcode May 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,6 @@ name: 'CodeQL'
on:
push:
branches: [main]
pull_request:
Copy link
Copy Markdown
Member

@markushi markushi May 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be honest I would still run CodeQL for PRs against main, as it will block the PR from being merged if there are CodeQL issues.

Copy link
Copy Markdown
Member

@romtsn romtsn May 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's probably fine to run it on main only, because I don't remember a single time where it failed for a valid reason 😅 We'll still get the notification if it's failed on main and see the results here: https://github.com/getsentry/sentry-java/security/code-scanning

The reason we don't want to run it on PRs because without build-cache it'd be the longest one to run. Alternatively we could skip the run altogether, if there were no code changes to prevent the job from failing, but I think it's a good middle-ground for now.

# The branches below must be a subset of the branches above
branches: [main]
schedule:
- cron: '17 23 * * 3'

Expand Down Expand Up @@ -46,7 +43,7 @@ jobs:

- name: Build Java
run: |
./gradlew buildForCodeQL
./gradlew buildForCodeQL --no-build-cache

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # pin@v2
Loading