Repository navigation
Fix repository-relative alert paths in CodeQL C# shards - #406
Merged
Merged
Conversation
Keep the source root at the repository root while retaining per-shard sparse checkout and existing analysis categories. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The narrow configuration change addresses alert path prefixes without changing shard scope or analysis categories, and no blocking issues were identified.
No open issues 🎉
What changed in this PR
This PR makes CodeQL C# alert paths repository-relative so they include sample-folder prefixes, while preserving shard extraction scope and analysis categories.
Changes:
- Sets
source-rootto the repository root for every shard. - Clarifies that sparse checkout controls C# extraction scope and cone mode retains root files.
| File | Description |
|---|---|
.github/workflows/codeql-analysis.yml |
Uses repository-root path attribution and clarifies sparse-checkout responsibilities. |
Review effort: Balanced
maartenba
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Set CodeQL
source-rootto the repository root for every shard so C# SARIF locations include their sample-folder prefixes. For example, alert #1442 currently reportsSessionMigration/Pages/Consent/Index.cshtml.csinstead ofIdentityServer/v8/SessionMigration/Pages/Consent/Index.cshtml.cs.Per-shard sparse checkout still limits C# buildless extraction to the selected sample folder. All analysis categories remain unchanged, including
.github/workflows/codeql-analysis.yml:analyze/language:javascript/for JavaScript. Updated the workflow comments to explain these separate responsibilities.Validation
actionlintv1.7.7 passes with only the existing custom runner-label diagnostic suppressed (ubuntu-latest-x64-16core); shellcheck/pyflakes checks are disabled.git diff --checkpasses.variousC# analysis completed successfully and uploaded under the unchanged/language:csharp/variouscategory with no analysis error. Other shards were still running at the last check.codeql-action/pr-diff-range), so this workflow-only change produces no C# findings to inspect. Repository-relative alert paths must be verified after merge in a full analysis onmain; they have not yet been verified from uploaded findings.