From 7329f12217ca49eaf13ea06f24ffa07adde21b1a Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Wed, 22 Jul 2026 11:10:18 +0200 Subject: [PATCH] ci(codeql): skip analysis on documentation-only changes CodeQL analyzes C# and TypeScript, so a commit touching only docs or markdown cannot change its result - it spent ~10 minutes (8:50 for C#, 1:32 for TypeScript) re-reporting an unchanged outcome. paths-ignore on push and pull_request only. The weekly cron stays unfiltered: it exists to catch advisories published against code that did not change, and it doubles as the backstop should the filter ever skip too much. A commit touching docs AND code still runs - GitHub skips only when every changed path matches the filter. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/codeql.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ffa14773..9dedf3d7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,12 +1,26 @@ name: CodeQL +# Documentation-only changes cannot affect what CodeQL analyzes (C# and +# TypeScript), so they are filtered out rather than spending ~10 minutes to +# re-report an unchanged result. A commit that touches docs AND code still runs: +# GitHub skips only when EVERY changed path matches the filter. on: push: branches: [main] + paths-ignore: + - 'docs/**' + - '**/*.md' + - 'LICENSE' pull_request: branches: [main] + paths-ignore: + - 'docs/**' + - '**/*.md' + - 'LICENSE' schedule: - # Weekly, so advisories published after a merge still surface. + # Weekly, so advisories published after a merge still surface. Deliberately + # unfiltered — it re-analyzes the whole tree regardless of what changed, which + # is also the backstop if the filters above ever skip too much. - cron: '17 3 * * 1' permissions: