improvement(ci): move CodeQL off default setup onto Blacksmith - #6219
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryLow Risk Overview The new
Reviewed by Cursor Bugbot for commit e29086b. Configure here. |
Greptile SummaryThe PR replaces GitHub CodeQL default setup with a repository-managed advanced setup using Blacksmith runners and scoped concurrency.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains; the previously reported production-route coverage hole is fixed by removing the broad test-directory exclusions.
|
| Filename | Overview |
|---|---|
| .github/codeql/codeql-config.yml | Adds extraction exclusions while retaining coverage of production routes under directories named test; the previously reported coverage hole is fixed. |
| .github/workflows/codeql.yml | Adds the advanced CodeQL workflow with Blacksmith runner selection, scoped cancellation, draft handling, pinned actions, and JavaScript/TypeScript plus Actions matrices. |
Reviews (2): Last reviewed commit: "fix(ci): restore CodeQL coverage of the ..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Default setup pinned every scan to a 4-vCPU GitHub-hosted runner with no cancel-in-progress: PR scans ran 30-125 min and re-ran on every push (#6183 burned six overlapping runs). None of that is reachable from the settings UI, so the config moves into the repo. - Blacksmith 8-vCPU via the same CI_PROVIDER escape hatch as ci.yml - cancel-in-progress scoped to pull_request so push/schedule scans finish - push to main + PR to main/staging + nightly safety net - paths filter so doc-only PRs skip the run entirely - paths-ignore config drops tests/mocks/fixtures: 12,716 -> 11,128 files - languages: javascript-typescript + actions; python dropped (7 files in tree) Default setup has been disabled; the two cannot both be active.
Review round 1. - Drop the '**/test/**' and '**/tests/**' globs. A `test` directory is a routable Next.js path segment, and those globs excluded apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts — a POST handler that authorizes, decrypts destination credentials and makes an outbound request. CodeQL paths-ignore has no `!` negation to carve it back out, and the globs only covered 76 of 12,716 files. - Add `ready_for_review` to the pull_request activity types. It is not a default type, so a PR opened as a draft and later marked ready was skipped by the draft guard and never rescanned until the next push.
1f1b2e7 to
e29086b
Compare
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit e29086b. Configure here.
1 participant
CodeQL was running via GitHub Advanced Security default setup — no workflow file, so no control over runner, triggers, or concurrency. Result: PR scans of 30–125 min on a 4-vCPU GitHub-hosted runner, re-running on every push. PR #6183 alone burned six overlapping runs (94/96/100/100/125/93 min).
This replaces it with advanced setup. Default setup has already been disabled — the two cannot both be active.
Changes
CI_PROVIDERescape-hatch expression asci.ymlcancel-in-progressscoped topull_request, mirroringci.yml:31, so push and scheduled scans still run to completionmain+ PR tomain/staging+ nightly safety net +workflow_dispatchpathsfilter so doc/config-only PRs skip the run entirelypaths-ignoreconfig dropping tests/mocks/fixtures: 12,716 → 11,128 extracted fileslanguages: [javascript-typescript, actions]— python dropped (7 files in the tree)persist-credentials: false, SHA-pinned actions,timeout-minutes: 60On the language list
Default setup listed
javascript,javascript-typescriptandtypescript. Those are aliases of one extractor (github/codeql-action→src/languages/builtin.json), so it was always a single analysis, not three — the logs showExtracting javascriptonce. Not a source of the slowness.Prior art
Modelled on how comparable OSS repos configure this. Notably, none of n8n, cal.com, supabase, twenty, PostHog, medusa, next.js or trigger.dev commit a CodeQL workflow at all. Among those that do:
javascript!tests/**) + weeklyjavascriptjavascriptKibana is the closest analogue (large TS tree) and solves it the same way: dedicated runner + aggressive
paths-ignore.Not adopted: kibana's
CODEQL_EXTRACTOR_JAVASCRIPT_OPTION_SKIP_TYPES: true. It is the largest single speedup available, but a GitHub code search returns 4 hits worldwide (kibana + a fork), it is undocumented, and it weakens type-based taint tracking. Available as an escape hatch if runtimes are still unacceptable.Verification owed