ci: add gate job to CodeQL workflow for text-only PRs#6346
Merged
brtnfld merged 2 commits intoHDFGroup:developfrom Apr 4, 2026
Merged
ci: add gate job to CodeQL workflow for text-only PRs#6346brtnfld merged 2 commits intoHDFGroup:developfrom
brtnfld merged 2 commits intoHDFGroup:developfrom
Conversation
Remove paths-ignore from the workflow trigger and add a check-changes job with dorny/paths-filter to detect code changes at the job level. This ensures the workflow always triggers so the codeql-complete gate job can report a passing status when analyze is skipped, preventing text-only PRs from being blocked by required status checks.
Add check-changes to the needs array of codeql-complete so that a failure in the change-detection job is not silently treated as a skipped analysis.
brtnfld
requested review from
bmribler,
derobins,
fortnern,
glennsong09,
jhendersonHDF,
lrknox,
mattjala,
qkoziol and
vchoi-hdfgroup
as code owners
jhendersonHDF
approved these changes
Apr 3, 2026
lrknox
approved these changes
Apr 4, 2026
github-project-automation
bot
moved this from In progress
to Done
in HDF5 - TRIAGE & TRACK
2 tasks
brtnfld
added a commit
that referenced
this pull request
Apr 4, 2026
* ci: add gate job to CodeQL workflow for text-only PRs Remove paths-ignore from the workflow trigger and add a check-changes job with dorny/paths-filter to detect code changes at the job level. This ensures the workflow always triggers so the codeql-complete gate job can report a passing status when analyze is skipped, preventing text-only PRs from being blocked by required status checks. * ci: check both check-changes and analyze results in gate job Add check-changes to the needs array of codeql-complete so that a failure in the change-detection job is not silently treated as a skipped analysis.
brtnfld
added a commit
to brtnfld/hdf5
that referenced
this pull request
Apr 17, 2026
* ci: add gate job to CodeQL workflow for text-only PRs Remove paths-ignore from the workflow trigger and add a check-changes job with dorny/paths-filter to detect code changes at the job level. This ensures the workflow always triggers so the codeql-complete gate job can report a passing status when analyze is skipped, preventing text-only PRs from being blocked by required status checks. * ci: check both check-changes and analyze results in gate job Add check-changes to the needs array of codeql-complete so that a failure in the change-detection job is not silently treated as a skipped analysis.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PRs that contain only text changes (e.g., markdown, documentation) are blocked from merging because the CodeQL required status check never reports a result when the workflow is skipped via
paths-ignore.This PR fixes the issue by:
paths-ignorefrom the workflow-level trigger so the workflow always runscheck-changesjob usingdorny/paths-filterto detect whether C/C++/CMake files were modifiedanalyzejob on actual code changes (or schedule/manual dispatch)codeql-completegate job that always runs and reports success when analysis was legitimately skippedHow it works
Required follow-up
After merging, update the branch protection rules for
developto useCodeQL / codeql-completeas the required status check instead ofCodeQL / Analyze.