This is an automated email from the ASF dual-hosted git repository. jacopoc pushed a commit to branch release24.09 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 60aaa0878bdb4c1ddb29869bf12c96c014eee9bb Author: Jacopo Cappellato <[email protected]> AuthorDate: Thu Oct 22 10:53:05 2026 +0200 Run the CodeQL analysis only when it is useful The ubuntu-latest runners are a limited resource shared by all the ASF projects, so avoid using them when the analysis cannot be affected: - trigger the workflow only for changes that can affect the analyzed sources, with the same paths filter as the Java CI workflow: changes to documentation, Windows scripts, legal/info files, Docker/IDE/devcontainer setup and other workflows no longer start an analysis; the weekly scheduled analysis runs anyway - cancel the analysis of a pull request that is still running or queued when a new commit is pushed to it; analyses of pushes to trunk and release* branches are never cancelled, and each of them gets its own concurrency group - skip the analysis of Dependabot pull requests, which only change dependency versions; the push of their merge is analyzed as any other push Co-Authored-By: Claude Opus 5.5 <[email protected]> (cherry picked from commit ca023e763acf95b9a592e427e5ad69d50461aa95) --- .github/workflows/codeql-analysis.yml | 42 +++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 0ebd1d2942..a4ad6f31dc 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -20,18 +20,60 @@ name: "CodeQL" on: push: branches: [ trunk, release* ] + # Changes that cannot affect the analyzed sources (documentation, Docker/IDE/devcontainer + # setup, Windows-only scripts, other workflows...) don't trigger the analysis: the + # ubuntu-latest runners are a limited resource shared by all the ASF projects. + # The weekly scheduled analysis runs anyway. + # GitHub evaluates these patterns in order, so a later pattern can re-include a path that an + # earlier "!" pattern excluded. + paths: &analysis-paths + - '**' + - '!**.md' + - '!**.adoc' + - '!**/src/docs/**' + - '!docs/**' + - '!**.bat' + - '!APACHE2_HEADER' + - '!INSTALL' + - '!LICENSE' + - '!NOTICE' + - '!OPTIONAL_LIBRARIES' + - '!VERSION' + - '!.asf.yaml' + - '!.devcontainer/**' + - '!.dockerignore' + - '!.gitattributes' + - '!.gitignore' + - '!.hgignore' + - '!.idea/**' + - '!.pre-commit-config.yaml' + - '!Dockerfile' + - '!docker/**' + - '!.github/**' + - '.github/workflows/codeql-analysis.yml' pull_request: # The branches below must be a subset of the branches above branches: [ trunk, release* ] + paths: *analysis-paths schedule: - cron: '27 15 * * 1' +# A new push to a pull request makes its previous, still running or queued analysis useless. +# Pushes to trunk and release* are never cancelled so that every commit gets its own result. +# Each of them gets its own group (run_id): in a shared group a newer run would replace a pending one. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + permissions: contents: read jobs: analyze: name: Analyze + # A Dependabot pull request only changes dependency versions, not the analyzed sources. + # The push of its merge is analyzed as any other push. + if: github.event.pull_request.user.login != 'dependabot[bot]' runs-on: ubuntu-latest permissions: actions: read
