mirror of
https://github.com/simstudioai/sim.git
synced 2026-08-31 01:11:53 +08:00
Waleed
09eba8a0f9
* improvement(ci): move CodeQL off default setup onto Blacksmith Default setup pinned every scan to a 4-vCPU GitHub-hosted runner with no cancel-in-progress: PR scans ran 30-125 min and re-ran on every push (#6183 burned six overlapping runs). None of that is reachable from the settings UI, so the config moves into the repo. - Blacksmith 8-vCPU via the same CI_PROVIDER escape hatch as ci.yml - cancel-in-progress scoped to pull_request so push/schedule scans finish - push to main + PR to main/staging + nightly safety net - paths filter so doc-only PRs skip the run entirely - paths-ignore config drops tests/mocks/fixtures: 12,716 -> 11,128 files - languages: javascript-typescript + actions; python dropped (7 files in tree) Default setup has been disabled; the two cannot both be active. * fix(ci): restore CodeQL coverage of the data-drain test route Review round 1. - Drop the '**/test/**' and '**/tests/**' globs. A `test` directory is a routable Next.js path segment, and those globs excluded apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts — a POST handler that authorizes, decrypts destination credentials and makes an outbound request. CodeQL paths-ignore has no `!` negation to carve it back out, and the globs only covered 76 of 12,716 files. - Add `ready_for_review` to the pull_request activity types. It is not a default type, so a PR opened as a draft and later marked ready was skipped by the draft guard and never rescanned until the next push.
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
name: Sim CodeQL config
|
|
|
|
# Trims the extraction surface. CodeQL parses every matching file into a
|
|
# database before a single query runs, and that phase dominates runtime on a
|
|
# ~12.7k-file JS/TS tree. Test and fixture code is not attacker-reachable, so
|
|
# excluding it costs no real coverage.
|
|
#
|
|
# paths-ignore applies to analysis. The workflow's `on.pull_request.paths`
|
|
# filter is separate and decides whether the run happens at all.
|
|
paths-ignore:
|
|
- '**/*.test.ts'
|
|
- '**/*.test.tsx'
|
|
- '**/*.test.js'
|
|
- '**/*.spec.ts'
|
|
- '**/*.spec.tsx'
|
|
- '**/__tests__/**'
|
|
- '**/__mocks__/**'
|
|
- '**/__fixtures__/**'
|
|
- '**/e2e/**'
|
|
# Deliberately no '**/test/**' or '**/tests/**'. A directory named `test` is a
|
|
# routable Next.js path segment, not necessarily test code: those globs
|
|
# excluded the real endpoint
|
|
# apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts,
|
|
# which authorizes, decrypts destination credentials, and makes an outbound
|
|
# request. CodeQL's paths-ignore has no `!` negation to carve it back out
|
|
# ("The filter pattern characters ?, +, [, ], and ! are not supported and will
|
|
# be matched literally"), and the globs only covered 76 of 12,716 files, so
|
|
# the naming convention above is the safer filter.
|
|
- '**/*.d.ts'
|
|
- '**/node_modules/**'
|
|
- '**/dist/**'
|
|
- '**/.next/**'
|
|
- 'apps/docs/content/**'
|