How to combine CodeQL with existing build jobs to avoid lengthy builds

[LordOfDragons]

Select Topic Area

Question

Body

I'm trying to add CodeQL to my repositories. With small repositories the default way works fine but I've got also a large repository. With this repository nightly builds take up 30mins for doing all the builds. For CodeQL I need only one of those builds but it takes over 20mins to build. It is a waste of time to build the code two times just to run CodeQL on the second build. It would be much better if I could add the CodeQL to the existing build job to avoid building twice to do the testing. I could though not figure out if this is possible and what it takes to get it working.

[mbg]

Hi @LordOfDragons 👋🏻

Thanks for the question. You should be able to do this by adding the codeql-action/init and codeql-action/analyze steps to your normal build workflow just before and just after your build step(s), respectively. In essence, you want something like this:

- # any setup steps you have to install language-specific tooling etc.

- uses: github/codeql-action/init@v3
  with:
    languages: # your language(s) here

- # your build step(s)

- uses: github/codeql-action/analyze@v3

CodeQL will automatically trace build steps that follow the init Action. You will however need to ensure that you perform a full build and don't e.g. rely on any sort of build cache for this.

See also the documentation for advanced setup and configuring advanced setup.

[LordOfDragons]

Can I also ignore specific path in CodeQL while doing so? For the full game engine build various external software is build too to achieve a self-sustained build. I do not want to check these external software. I did not figure out so far how I can prevent CodeQL from doing this. All external software is stored and build under a unique path (root directory "external").

[mbg]

Yes, assuming that building the code in your external directory is not necessary to build the rest of your project. Since you are specifying what build step(s) you are putting in your workflow, you can choose ones which only build the parts of the project that you want to scan.

[LordOfDragons]

I see. That requires rewriting the build step since it builds everything in one step. But it should be doable.

[mbg]

Feel free to follow up here if you need more help or run into any problems!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬