mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
9eb8cac507
Every "chore: bump internal gitlink" commit ran the full CI matrix and both CodeQL analyses, because a gitlink bump reports the bare path 'internal' (no trailing slash) and the existing 'internal/**' filter does not match it. Both workflows now ignore the bare and nested forms of the three private submodule paths plus markdown, LICENSE and the .github metadata files. CodeQL's weekly unfiltered schedule remains the backstop. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
95 lines
2.7 KiB
YAML
95 lines
2.7 KiB
YAML
name: CodeQL
|
|
|
|
# Documentation-only changes and private-submodule gitlink bumps (internal/, infra/,
|
|
# .claude/commands) cannot affect what CodeQL analyzes (C# and TypeScript), so they
|
|
# are filtered out rather than spending ~10 minutes to re-report an unchanged result.
|
|
# A gitlink bump reports the bare path ('internal', no trailing slash), which
|
|
# 'internal/**' does NOT match — both forms are listed. A commit that touches docs
|
|
# AND code still runs: GitHub skips only when EVERY changed path matches the filter.
|
|
# Same list as ci.yml; keep them in step.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- 'internal'
|
|
- 'internal/**'
|
|
- 'infra'
|
|
- 'infra/**'
|
|
- '.claude/**'
|
|
- '.gitmodules'
|
|
- '**/*.md'
|
|
- 'LICENSE'
|
|
- '.github/ISSUE_TEMPLATE/**'
|
|
- '.github/FUNDING.yml'
|
|
- '.github/dependabot.yml'
|
|
- '.github/assets/**'
|
|
pull_request:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- 'internal'
|
|
- 'internal/**'
|
|
- 'infra'
|
|
- 'infra/**'
|
|
- '.claude/**'
|
|
- '.gitmodules'
|
|
- '**/*.md'
|
|
- 'LICENSE'
|
|
- '.github/ISSUE_TEMPLATE/**'
|
|
- '.github/FUNDING.yml'
|
|
- '.github/dependabot.yml'
|
|
- '.github/assets/**'
|
|
schedule:
|
|
# Weekly, so advisories published after a merge still surface. Deliberately
|
|
# unfiltered — it re-analyzes the whole tree regardless of what changed, which
|
|
# is also the backstop if the filters above ever skip too much.
|
|
- cron: '17 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze ${{ matrix.language }}
|
|
runs-on: ${{ matrix.runner }}
|
|
permissions:
|
|
security-events: write
|
|
packages: read
|
|
actions: read
|
|
contents: read
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# csharp needs the net48 agent projects to build, so Windows.
|
|
- language: csharp
|
|
runner: windows-latest
|
|
build-mode: manual
|
|
- language: javascript-typescript
|
|
runner: ubuntu-latest
|
|
build-mode: none
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-dotnet@v6
|
|
if: matrix.language == 'csharp'
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4.37.9
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
config-file: .github/codeql/codeql-config.yml
|
|
|
|
- name: Build
|
|
if: matrix.build-mode == 'manual'
|
|
run: dotnet build AutopilotMonitor.sln --configuration Release
|
|
|
|
- name: Analyze
|
|
uses: github/codeql-action/analyze@v4.37.9
|
|
with:
|
|
category: /language:${{ matrix.language }}
|