From 4e46c0946d17df8383f5488cf643119dad172245 Mon Sep 17 00:00:00 2001 From: "Piotr P. Karwasz" Date: Wed, 16 Sep 2026 13:14:13 +0200 Subject: [PATCH 1/2] Remove duplicate CodeQL workflow and tidy codeql-analysis.yml The repository had two workflows named "CodeQL": the original codeql-analysis.yml (Python and Actions) and a later codeql.yml (Actions only). Both uploaded results under the same category, so the Actions language was scanned twice on every push and PR. Delete codeql.yml and clean up the surviving workflow: - run on ubuntu-latest - use block-style lists for the branches and language arrays - move the daily schedule off the top of the hour - cancel in-progress runs only for pull requests - set top-level permissions to {} and grant only security-events: write on the job, since read permissions are implicit on a public repository - drop the Autobuild step, which is a no-op for Python and Actions Assisted-By: Claude Fable 5.1 --- .github/workflows/codeql-analysis.yml | 34 +++++++++------- .github/workflows/codeql.yml | 56 --------------------------- 2 files changed, 20 insertions(+), 70 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 2cbcd3371..0b5229bfa 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -18,34 +18,43 @@ # # --- +# Static analysis of the Python sources and the GitHub Actions workflows. +# Results are uploaded to the "Security" tab of the repository. name: "CodeQL" on: # yamllint disable-line rule:truthy pull_request: - branches: ['main'] + branches: + - "main" push: - branches: [main] + branches: + - "main" schedule: - - cron: '0 2 * * *' + # Off the top of the hour to avoid the load peak on GitHub's runners. + - cron: '23 2 * * *' + +# Permissions are set on each job individually. +permissions: {} -permissions: - contents: read concurrency: group: codeql-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true + # Only PR runs are superseded by a newer push. + # Push and scheduled runs must complete to keep the Security tab current. + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: analyze: name: Analyze - runs-on: ["ubuntu-22.04"] + runs-on: ubuntu-latest strategy: fail-fast: false matrix: - language: ['python', 'actions'] + language: + - "python" + - "actions" permissions: - actions: read - contents: read - pull-requests: read + # Required to upload the SARIF results. + # Read permissions are implicit on a public repository. security-events: write steps: - name: Checkout repository @@ -58,8 +67,5 @@ jobs: with: languages: ${{ matrix.language }} - - name: Autobuild - uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 2019633dc..000000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,56 +0,0 @@ -# -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. -# - -name: "CodeQL" - -on: - push: - branches: [ "main" ] - pull_request: - branches: [ "main" ] - schedule: - - cron: '16 4 * * 1' - -permissions: - contents: read - -jobs: - analyze: - name: Analyze Actions - runs-on: ubuntu-slim - permissions: - contents: read - security-events: write - packages: read - - steps: - - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Initialize CodeQL - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - with: - languages: actions - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 - with: - category: "/language:actions" From 91e0778ed79b41025a6fde06fb60b533823eca11 Mon Sep 17 00:00:00 2001 From: "Piotr P. Karwasz" Date: Wed, 16 Sep 2026 14:12:11 +0200 Subject: [PATCH 2/2] Use `ubuntu-slim` Co-authored-by: Jarek Potiuk Signed-off-by: Piotr P. Karwasz --- .github/workflows/codeql-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 0b5229bfa..bf2956991 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -45,7 +45,7 @@ concurrency: jobs: analyze: name: Analyze - runs-on: ubuntu-latest + runs-on: ubuntu-slim strategy: fail-fast: false matrix: