From 678409e5a360cc74946b0c2137a6f4a20f1254b3 Mon Sep 17 00:00:00 2001 From: Damian Hickey Date: Mon, 26 Oct 2026 23:12:36 +0100 Subject: [PATCH 1/4] Speed up CodeQL: dependency caching, PR concurrency, shard C# analysis Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 32 ++++++++++++++++++--------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 4af39887..1d3c27fb 100755 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -4,11 +4,6 @@ # You may wish to alter this file to override the set of languages analyzed, # or to provide custom queries or build logic. # -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# name: "CodeQL" on: @@ -20,20 +15,33 @@ on: schedule: - cron: '34 0 * * 5' +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: analyze: - name: Analyze + name: Analyze (${{ matrix.language }}, ${{ matrix.shard }}) runs-on: group: Large labels: [ubuntu-latest-x64-16core] strategy: fail-fast: false + # C# is split by sample folder so dependency restore and extraction run in parallel. + # Each shard uploads results under its own category. matrix: - language: [ 'csharp', 'javascript' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] - # Learn more: - # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed + include: + - language: csharp + shard: IdentityServer/v7 + - language: csharp + shard: IdentityServer/v8 + - language: csharp + shard: BFF + - language: csharp + shard: various + - language: javascript + shard: all steps: - name: Checkout repository @@ -45,6 +53,8 @@ jobs: with: languages: ${{ matrix.language }} build-mode: none + source-root: ${{ matrix.shard == 'all' && '.' || matrix.shard }} + dependency-caching: true # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. @@ -52,3 +62,5 @@ jobs: - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 + with: + category: /language:${{ matrix.language }}${{ matrix.shard != 'all' && format('/{0}', matrix.shard) || '' }} From 17c83bbf383b60b321b891912d3a28c7e49edfd3 Mon Sep 17 00:00:00 2001 From: Damian Hickey Date: Mon, 26 Oct 2026 23:25:21 +0100 Subject: [PATCH 2/4] CodeQL: cache C# buildless dependencies, keep JS category Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 1d3c27fb..9f603141 100755 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -47,6 +47,18 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + # build-mode none restores NuGet packages into a temp dir via `dotnet restore --packages`, + # ignoring ~/.nuget/packages. CODEQL_EXTRACTOR_CSHARP_OPTION_BUILDLESS_DEPENDENCY_DIR (set on + # the analyze step) makes it use a persistent dir instead, which is cached here per shard. + - name: Cache CodeQL C# dependencies + if: matrix.language == 'csharp' + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: ${{ runner.temp }}/codeql-csharp-deps + key: codeql-csharp-deps-${{ runner.os }}-${{ matrix.shard }}-${{ hashFiles(format('{0}/**/*.csproj', matrix.shard), format('{0}/**/Directory.Packages.props', matrix.shard), format('{0}/**/Directory.Build.props', matrix.shard), format('{0}/**/packages.config', matrix.shard), format('{0}/**/nuget.config', matrix.shard), 'global.json', 'nuget.config') }} + restore-keys: | + codeql-csharp-deps-${{ runner.os }}-${{ matrix.shard }}- + # Analysis runs without compiling the samples; compilation is verified by the Build workflow. - name: Initialize CodeQL uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 @@ -54,7 +66,6 @@ jobs: languages: ${{ matrix.language }} build-mode: none source-root: ${{ matrix.shard == 'all' && '.' || matrix.shard }} - dependency-caching: true # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. @@ -62,5 +73,8 @@ jobs: - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 + env: + CODEQL_EXTRACTOR_CSHARP_OPTION_BUILDLESS_DEPENDENCY_DIR: ${{ matrix.language == 'csharp' && format('{0}/codeql-csharp-deps', runner.temp) || '' }} with: - category: /language:${{ matrix.language }}${{ matrix.shard != 'all' && format('/{0}', matrix.shard) || '' }} + # JavaScript keeps its pre-sharding default category so existing alerts continue to update. + category: ${{ matrix.language == 'javascript' && '.github/workflows/codeql-analysis.yml:analyze/language:javascript/' || format('/language:{0}/{1}', matrix.language, matrix.shard) }} From 7b1705e5c2d2738477cab5f1c58535cdb615c278 Mon Sep 17 00:00:00 2001 From: Damian Hickey Date: Mon, 26 Oct 2026 23:41:18 +0100 Subject: [PATCH 3/4] CodeQL: sparse-checkout C# shards so buildless extraction only sees the shard Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 9f603141..083c3819 100755 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -44,8 +44,12 @@ jobs: shard: all steps: + # C# buildless extraction scans the whole checkout regardless of source-root, so C# shards + # sparse-checkout only their folder (cone mode keeps root files such as global.json and nuget.config). - name: Checkout repository uses: actions/checkout@v4 + with: + sparse-checkout: ${{ matrix.shard != 'all' && matrix.shard || '' }} # build-mode none restores NuGet packages into a temp dir via `dotnet restore --packages`, # ignoring ~/.nuget/packages. CODEQL_EXTRACTOR_CSHARP_OPTION_BUILDLESS_DEPENDENCY_DIR (set on From 691566b679c02c0ecd0e0c21269c652e14241a59 Mon Sep 17 00:00:00 2001 From: Damian Hickey Date: Tue, 27 Oct 2026 00:00:43 +0100 Subject: [PATCH 4/4] CodeQL: drop C# dependency cache (measured slower, 6.4 GB cache usage) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql-analysis.yml | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 083c3819..3d488ddb 100755 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -51,18 +51,6 @@ jobs: with: sparse-checkout: ${{ matrix.shard != 'all' && matrix.shard || '' }} - # build-mode none restores NuGet packages into a temp dir via `dotnet restore --packages`, - # ignoring ~/.nuget/packages. CODEQL_EXTRACTOR_CSHARP_OPTION_BUILDLESS_DEPENDENCY_DIR (set on - # the analyze step) makes it use a persistent dir instead, which is cached here per shard. - - name: Cache CodeQL C# dependencies - if: matrix.language == 'csharp' - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: ${{ runner.temp }}/codeql-csharp-deps - key: codeql-csharp-deps-${{ runner.os }}-${{ matrix.shard }}-${{ hashFiles(format('{0}/**/*.csproj', matrix.shard), format('{0}/**/Directory.Packages.props', matrix.shard), format('{0}/**/Directory.Build.props', matrix.shard), format('{0}/**/packages.config', matrix.shard), format('{0}/**/nuget.config', matrix.shard), 'global.json', 'nuget.config') }} - restore-keys: | - codeql-csharp-deps-${{ runner.os }}-${{ matrix.shard }}- - # Analysis runs without compiling the samples; compilation is verified by the Build workflow. - name: Initialize CodeQL uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 @@ -77,8 +65,6 @@ jobs: - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 - env: - CODEQL_EXTRACTOR_CSHARP_OPTION_BUILDLESS_DEPENDENCY_DIR: ${{ matrix.language == 'csharp' && format('{0}/codeql-csharp-deps', runner.temp) || '' }} with: # JavaScript keeps its pre-sharding default category so existing alerts continue to update. category: ${{ matrix.language == 'javascript' && '.github/workflows/codeql-analysis.yml:analyze/language:javascript/' || format('/language:{0}/{1}', matrix.language, matrix.shard) }}