tools: enable CodeQL config file

Trott · RafaelGSS · commit 25c17ab36548 · 2025-05-02T17:06:53.000-03:00
A previous change designed to ignore test files in CodeQL scans had multiple problems. This fixes the CodeQL scan breakage. It adds a CodeQL config file, which allows us to ignore the test directory in our scans. Refs: #57978 (comment) Refs: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#specifying-directories-to-scan PR-URL: #58036 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml
@@ -0,0 +1,4 @@
+name: CodeQL config
+
+paths-ignore:
+  - test
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -7,9 +7,6 @@ on:
 permissions:
   contents: read
 
-paths-to-ignore:
-  - test
-
 jobs:
   analyze:
     name: Analyze
@@ -33,6 +30,7 @@ jobs:
         uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5  # v3.28.11
         with:
           languages: ${{ matrix.language }}
+          config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5  # v3.28.11

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +name: CodeQL config
++
 +paths-ignore:
 +  - test