From e3bccc86d516e3fd0a6a7d0ffa976b46e8a913e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 25 Sep 2026 19:55:56 +0200 Subject: [PATCH] ci(codeql): analyse every push to main A commit that reaches main without a pull request, such as an asset uploaded through the web UI, was never analysed until the weekly run. Run on push to main as well. Pull-request runs still cancel their superseded heads; push runs are grouped per commit and never cancelled, so back-to-back merges each keep their own analysis. --- .github/workflows/codeql.yml | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4ab4907de..561782a87 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -5,12 +5,15 @@ name: CodeQL # settings, so the query suite, the excluded paths and the schedule are # reviewable in the diff like everything else here. # -# Deliberately NOT on `push: main`. The weekly run already analyses the -# default branch, which is what keeps the Security tab current, and every -# change reaches `main` through a pull request that is analysed on the way -# in. Adding a push trigger would analyse the same tree a second time -# minutes later for no additional signal. +# Runs on every push to `main` as well as on pull requests. Most changes +# reach `main` through a pull request that is analysed on the way in, but +# not all of them: an asset uploaded through the web UI or a maintenance +# commit pushed directly lands without one, and the weekly run would only +# catch it days later. The push run re-analyses a merged tree once more, +# which is the cost of every commit on `main` having an analysis of its own. on: + push: + branches: [main] pull_request: branches: [main] schedule: @@ -22,9 +25,13 @@ on: permissions: contents: read +# A pull request keeps only its newest run: an older head is superseded and +# never merged. A push to `main` is grouped by commit and never cancelled, so +# two merges in quick succession each keep their own analysis instead of the +# second one cancelling (or replacing the queued run of) the first. concurrency: - group: codeql-${{ github.ref }} - cancel-in-progress: true + group: codeql-${{ github.event_name }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: analyze: