Repository navigation
ci(codeql): drop the unused build and cache the Rust extractor's cargo output - #320
Merged
Merged
Conversation
…o output CodeQL analyzes Rust without a build, and the extractor runs its own cargo commands in a fresh scratch target directory on every run, so the workflow's `cargo build` step never fed it. Remove that step (about 2 minutes per run). Point the extractor at a persistent target directory via `CODEQL_ACTION_EXTRA_OPTIONS` (`rust.cargo_target_dir`) and cache it, along with the cargo registry, so build scripts and proc macros are not recompiled from scratch each run. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
jpage-godaddy
requested review from
axburgess-godaddy,
jpearlman-godaddy,
mguerrero3-godaddy,
qcai-godaddy and
rts1-godaddy
as code owners
October 12, 2026 20:43
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused workflow changes are internally consistent and preserve CodeQL analysis behavior.
0 open findings
What changed in this PR
Removes redundant CodeQL compilation and caches Rust extractor artifacts to reduce analysis time.
Changes:
- Removes the unused
cargo build. - Caches Cargo dependencies and extractor output.
- Configures a persistent extractor target directory.
| File | Description |
|---|---|
.github/workflows/codeql-analysis.yml |
Optimizes Rust CodeQL analysis and caching. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CodeQL runs on this repo take about 10 minutes. Roughly 2 minutes of that is a
cargo buildstep that the analysis never uses, and about 1m45s of extraction is the Rust extractor compiling build scripts and proc macros from scratch.cargo buildstep. Rust is analyzed without a build, and the extractor runs its own cargo commands in a scratchCARGO_TARGET_DIRthat is empty on every run, so our build output was never reused. Removing it also stops the extractor from picking up generatedrust/target/**/out/*.rsfiles and logging "semantic analyzer unavailable" warnings for them.CODEQL_ACTION_EXTRA_OPTIONSpasses--extractor-option rust.cargo_target_dir=<runner temp>/codeql-rust-targetto the extraction step, and that directory is cached together with~/.cargo/registryand~/.cargo/git, keyed onrust/Cargo.lock.Expected effect: about 2 minutes saved on every run, and more once the cache is warm.
Verifying
Not yet exercised on CI, so check on this PR's run:
cargo_target_dir: Some(".../codeql-rust-target")(it wasNone). If it is stillNone, the option isn't being applied. The cache is then harmless but pointless, and only the build-step removal helps.number of inputsdrops from 228 (the generated files are no longer included) and the alert results are unchanged frommain.main. The speedup shows on the second run, or after the first push tomain.cicd.ymlalready caches about 1.8 GB against the 10 GB repo limit.🤖 Generated with Claude Code