This is an automated email from the ASF dual-hosted git repository. jacopoc pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 1177219b576f2e67a5f6886516fc5aff36016075 Author: Jacopo Cappellato <[email protected]> AuthorDate: Thu Oct 22 10:53:05 2026 +0200 Run the CodeQL analysis only when it is useful The ubuntu-latest runners are a limited resource shared by all the ASF projects, so avoid using them when the analysis cannot be affected: - trigger the workflow only for changes that can affect the analyzed sources, with the same paths filter as the Java CI workflow: changes to documentation, Windows scripts, legal/info files, Docker/IDE/devcontainer setup and other workflows no longer start an analysis; the weekly scheduled analysis runs anyway - cancel the analysis of a pull request that is still running or queued when a new commit is pushed to it; analyses of pushes to trunk and release* branches are never cancelled, and each of them gets its own concurrency group - skip the analysis of Dependabot pull requests, which only change dependency versions; the push of their merge is analyzed as any other push Document the new triggers in README-CI-CD.md. Co-Authored-By: Claude Opus 5.5 <[email protected]> --- .github/README-CI-CD.md | 2 +- .github/workflows/codeql-analysis.yml | 42 +++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 1 deletion(-) diff --git a/.github/README-CI-CD.md b/.github/README-CI-CD.md index 3297a0c315..d4251946fc 100644 --- a/.github/README-CI-CD.md +++ b/.github/README-CI-CD.md @@ -8,7 +8,7 @@ - `codeql-analysis.yml` Security analysis (Java + JavaScript) - → Trigger: push / PR + weekly on `trunk` and `release*` + → Trigger: push / PR (except Dependabot PRs) + weekly on `trunk` and `release*`, skipped when only documentation or setup files change - `docker-image.yml` Build and push images to `ghcr.io/apache/ofbiz` diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index dc1f85d67f..aa003cb6e0 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -20,18 +20,60 @@ name: "CodeQL" on: push: branches: [ trunk, release* ] + # Changes that cannot affect the analyzed sources (documentation, Docker/IDE/devcontainer + # setup, Windows-only scripts, other workflows...) don't trigger the analysis: the + # ubuntu-latest runners are a limited resource shared by all the ASF projects. + # The weekly scheduled analysis runs anyway. + # GitHub evaluates these patterns in order, so a later pattern can re-include a path that an + # earlier "!" pattern excluded. + paths: &analysis-paths + - '**' + - '!**.md' + - '!**.adoc' + - '!**/src/docs/**' + - '!docs/**' + - '!**.bat' + - '!APACHE2_HEADER' + - '!INSTALL' + - '!LICENSE' + - '!NOTICE' + - '!OPTIONAL_LIBRARIES' + - '!VERSION' + - '!.asf.yaml' + - '!.devcontainer/**' + - '!.dockerignore' + - '!.gitattributes' + - '!.gitignore' + - '!.hgignore' + - '!.idea/**' + - '!.pre-commit-config.yaml' + - '!Dockerfile' + - '!docker/**' + - '!.github/**' + - '.github/workflows/codeql-analysis.yml' pull_request: # The branches below must be a subset of the branches above branches: [ trunk, release* ] + paths: *analysis-paths schedule: - cron: '27 15 * * 1' +# A new push to a pull request makes its previous, still running or queued analysis useless. +# Pushes to trunk and release* are never cancelled so that every commit gets its own result. +# Each of them gets its own group (run_id): in a shared group a newer run would replace a pending one. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + permissions: contents: read jobs: analyze: name: Analyze + # A Dependabot pull request only changes dependency versions, not the analyzed sources. + # The push of its merge is analyzed as any other push. + if: github.event.pull_request.user.login != 'dependabot[bot]' runs-on: ubuntu-latest permissions: actions: read
