mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-01 14:59:19 +08:00
Waleed
dca1fd60be
Feature PRs land on staging and are ~90% of PR scan volume (90 of the last 100 PRs target staging, 4 target main). Every one of them is scanned again — against the exact tree being promoted — when the staging->main PR opens, so restricting PR scans to main defers the signal to the promotion boundary rather than dropping it. No ruleset or branch protection requires a CodeQL check, and the alert view is fed by the push-to-main and scheduled analyses, not by PR runs. Deliberately a branch cut rather than an activity-type cut. Dropping `synchronize` would have cut a similar share of runs, but it scans a PR's first commit and never its final state — backwards, since review fixups land in later pushes. The scheduled scan moves from weekly to daily. Pushes to main are rare, so with PR scans limited to main the default-branch alert view leans on the cron more than it used to, and a week is too long to leave it stale. It also reseeds the overlay-base database that PR runs restore from: that cache key embeds the CodeQL bundle version, so a bundle bump invalidates it, and an unused Actions cache is evicted after 7 days. Also records, in codeql-config.yml, why the obvious speed-up is a trap: adding `queries:`/`packs:`/`query-filters:` trips OverlayDisabledReason.NonDefaultQueries and permanently disables overlay analysis, trading a documented up-to-10x win on the extraction phase (~53% of a run) for a few percent off the query phase.
42 lines
1.8 KiB
YAML
42 lines
1.8 KiB
YAML
name: Sim CodeQL config
|
|
|
|
# Trims the extraction surface. CodeQL parses every matching file into a
|
|
# database before a single query runs, and that phase dominates runtime on a
|
|
# ~12.7k-file JS/TS tree. Test and fixture code is not attacker-reachable, so
|
|
# excluding it costs no real coverage.
|
|
#
|
|
# paths-ignore applies to analysis. The workflow's `on.pull_request.paths`
|
|
# filter is separate and decides whether the run happens at all.
|
|
paths-ignore:
|
|
- '**/*.test.ts'
|
|
- '**/*.test.tsx'
|
|
- '**/*.test.js'
|
|
- '**/*.spec.ts'
|
|
- '**/*.spec.tsx'
|
|
- '**/__tests__/**'
|
|
- '**/__mocks__/**'
|
|
- '**/__fixtures__/**'
|
|
- '**/e2e/**'
|
|
# Deliberately no '**/test/**' or '**/tests/**'. A directory named `test` is a
|
|
# routable Next.js path segment, not necessarily test code: those globs
|
|
# excluded the real endpoint
|
|
# apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts,
|
|
# which authorizes, decrypts destination credentials, and makes an outbound
|
|
# request. CodeQL's paths-ignore has no `!` negation to carve it back out
|
|
# ("The filter pattern characters ?, +, [, ], and ! are not supported and will
|
|
# be matched literally"), and the globs only covered 76 of 12,716 files, so
|
|
# the naming convention above is the safer filter.
|
|
- '**/*.d.ts'
|
|
- '**/node_modules/**'
|
|
- '**/dist/**'
|
|
- '**/.next/**'
|
|
- 'apps/docs/content/**'
|
|
|
|
# Do NOT add `queries:`, `packs:`, `query-filters:`, or `disable-default-queries`
|
|
# here to try to speed the scan up. Under the code-scanning feature flag the
|
|
# action's checkOverlayAnalysisFeatureEnabled treats any of those as
|
|
# OverlayDisabledReason.NonDefaultQueries and permanently turns off overlay
|
|
# (incremental) analysis. Extraction is ~53% of a run and is exactly what overlay
|
|
# skips, so scoping the queries trades a documented up-to-10x win for a few
|
|
# percent off the 27% query phase.
|