codeant-ai-for-open-source[bot] commented on code in PR #44699:
URL: https://github.com/apache/superset/pull/44699#discussion_r4111014960
##########
.github/workflows/codeql-analysis.yml:
##########
@@ -66,18 +65,38 @@ jobs:
persist-credentials: false
# Initializes the CodeQL tools for scanning.
- - name: Initialize CodeQL
+ - name: Initialize CodeQL (python)
+ if: needs.changes.outputs.python == 'true'
uses:
github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
with:
- languages: ${{ matrix.language }}
+ languages: python
Review Comment:
**Suggestion:** The matrix creates two jobs, but these hardcoded language
steps ignore `matrix.language`, duplicating scans and running both
initializations in each job when both change groups are present.
**Assessment:** ๐ `Major` ยท ๐ `Occurrence: Often` ยท ๐ท๏ธ `Performance`
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=c6d6082106314c678ff7c57d999d2aab&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=c6d6082106314c678ff7c57d999d2aab&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** .github/workflows/codeql-analysis.yml
**Line:** 68:72
**Comment:**
*Performance: The matrix creates two jobs, but these hardcoded language
steps ignore `matrix.language`, duplicating scans and running both
initializations in each job when both change groups are present.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=21cb9f470c075c6323842c2865eec78c02c3abb6ffaa1b9f158f619da1a5bc07&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=21cb9f470c075c6323842c2865eec78c02c3abb6ffaa1b9f158f619da1a5bc07&reaction=dislike'>๐</a>
##########
.github/workflows/codeql-analysis.yml:
##########
@@ -66,18 +65,38 @@ jobs:
persist-credentials: false
# Initializes the CodeQL tools for scanning.
- - name: Initialize CodeQL
+ - name: Initialize CodeQL (python)
+ if: needs.changes.outputs.python == 'true'
uses:
github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
with:
- languages: ${{ matrix.language }}
+ languages: python
# If you wish to specify custom queries, you can do so here or in a
config file.
# By default, queries listed here will override any specified in a
config file.
# Prefix the list here with "+" to use these queries and those in
the config file.
# For more details on CodeQL's query packs, refer to:
https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
# queries: security-extended,security-and-quality
- - name: Perform CodeQL Analysis
+ - name: Initialize CodeQL (javascript)
+ if: needs.changes.outputs.frontend == 'true'
+ uses:
github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+ with:
+ languages: javascript
+ # If you wish to specify custom queries, you can do so here or in a
config file.
+ # By default, queries listed here will override any specified in a
config file.
+ # Prefix the list here with "+" to use these queries and those in
the config file.
+
+ # For more details on CodeQL's query packs, refer to:
https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+ # queries: security-extended,security-and-quality
+
+ - name: Perform CodeQL Analysis (python)
+ if: needs.changes.outputs.python == 'true'
+ uses:
github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+ with:
+ category: "/language:python"
+
+ - name: Perform CodeQL Analysis (javascript)
+ if: needs.changes.outputs.python == 'true'
uses:
github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
with:
- category: "/language:${{matrix.language}}"
+ category: "/language:javascript"
Review Comment:
**Suggestion:** The JavaScript analysis is gated by `python`, so
frontend-only changes initialize JavaScript but never analyze it, while
Python-only changes analyze without a JavaScript database.
**Assessment:** ๐ `Major` ยท ๐ `Occurrence: Often` ยท ๐ท๏ธ `Incorrect condition
logic`
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=ae72818f89134f9b820f8e34877923e8&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=ae72818f89134f9b820f8e34877923e8&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** .github/workflows/codeql-analysis.yml
**Line:** 98:102
**Comment:**
*Incorrect Condition Logic: The JavaScript analysis is gated by
`python`, so frontend-only changes initialize JavaScript but never analyze it,
while Python-only changes analyze without a JavaScript database.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=9adaefd33d9e4bfafc4293236d803f1f0a3453aa0903c5147161fbe579092f29&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44699&comment_hash=9adaefd33d9e4bfafc4293236d803f1f0a3453aa0903c5147161fbe579092f29&reaction=dislike'>๐</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
