Skip to content

Enhance overview of parallelizing CodeQL analysis#72

Open
felickz wants to merge 2 commits intomainfrom
parallel-codeql-actions
Open

Enhance overview of parallelizing CodeQL analysis#72
felickz wants to merge 2 commits intomainfrom
parallel-codeql-actions

Conversation

@felickz
Copy link
Copy Markdown
Contributor

@felickz felickz commented Apr 1, 2026

Clarified the overview section and improved the explanation of the benefits of parallelizing MISRA analysis.

Clarified the overview section and improved the explanation of the benefits of parallelizing MISRA analysis.
Copilot AI review requested due to automatic review settings April 1, 2026 16:29
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new guide explaining how to parallelize CodeQL analysis (focused on MISRA C / MISRA C++) by separating database creation from query execution and fanning out analysis across multiple GitHub Actions jobs.

Changes:

  • Introduces a new documentation page describing the skip-queries pattern to build once and analyze in parallel.
  • Provides a full workflow example (build DB → upload artifact → parallel MISRA analyses → SARIF uploads).
  • Documents key considerations (categories, artifact sizing, version pinning, limitations).


By default, the CodeQL Action builds a database and runs queries sequentially in a single job.

We will use an example safety-critical codebases that must comply with **MISRA C** and **MISRA C++** standards, running both rule sets sequentially can result in long-running workflows. You can **decouple database creation from query execution** using the [`skip-queries`](https://github.com/github/codeql-action/blob/main/analyze/action.yml#L39-L40) input, then fan out MISRA analysis across parallel jobs using GitHub Actions artifacts.
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The overview sentence has a grammatical error and is hard to parse (“an example safety-critical codebases…”). Consider rewriting to singular “codebase” (or “example of a safety-critical codebase”) and splitting into two sentences for readability.

Suggested change
We will use an example safety-critical codebases that must comply with **MISRA C** and **MISRA C++** standards, running both rule sets sequentially can result in long-running workflows. You can **decouple database creation from query execution** using the [`skip-queries`](https://github.com/github/codeql-action/blob/main/analyze/action.yml#L39-L40) input, then fan out MISRA analysis across parallel jobs using GitHub Actions artifacts.
We will use an example of a safety-critical codebase that must comply with **MISRA C** and **MISRA C++** standards. Running both rule sets sequentially can result in long-running workflows. You can **decouple database creation from query execution** using the [`skip-queries`](https://github.com/github/codeql-action/blob/main/analyze/action.yml#L39-L40) input, then fan out MISRA analysis across parallel jobs using GitHub Actions artifacts.

Copilot uses AI. Check for mistakes.
Comment on lines +25 to +26
When set to `"true"`, the action:

Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inline code is rendering escaped quotes (\"true\"). In Markdown you can write this as "true" without backslashes (or just true), otherwise the backslashes will appear in the rendered doc.

Copilot uses AI. Check for mistakes.
Comment thread code-scanning-guides/parallelizing-codeql-analysis.md Outdated
Comment on lines +82 to +83
outputs:
db-locations: ${{ steps.analyze.outputs.db-locations }}
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

build-db publishes an outputs.db-locations, but the workflow never uses it. Either remove this output to reduce confusion, or show how downstream jobs can consume it (for example, to set the artifact path or to avoid hard-coding the database directory).

Suggested change
outputs:
db-locations: ${{ steps.analyze.outputs.db-locations }}

Copilot uses AI. Check for mistakes.

### Using `if: always()` on SARIF Upload

The `upload-sarif` step uses `if: always()` so that even if the analysis step finds violations and returns a non-zero exit code, the SARIF file is still uploaded. This ensures you always see results in Code Scanning.
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The note about if: always() is misleading: CodeQL analysis typically does not exit non-zero just because it found alerts/violations; non-zero is more commonly due to execution errors. Suggest rewording to “even if the analysis command fails” (or documenting --fail-on/equivalent if you intend to fail the job on findings).

Suggested change
The `upload-sarif` step uses `if: always()` so that even if the analysis step finds violations and returns a non-zero exit code, the SARIF file is still uploaded. This ensures you always see results in Code Scanning.
The `upload-sarif` step uses `if: always()` so that even if the analysis command fails (for example, due to an internal error or because you have configured it to fail on findings), the SARIF file is still uploaded. This ensures you always see results in Code Scanning.

Copilot uses AI. Check for mistakes.
Comment on lines +226 to +229
### CodeQL CLI Availability

The `codeql` CLI is pre-installed on all GitHub-hosted runners and is already on the `PATH`. You do not need to run the `init` action in the parallel jobs — just use `codeql` directly.

Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow relies on codeql being available in the MISRA fan-out jobs, but those jobs never run github/codeql-action/init (which is what typically downloads/pins the CodeQL tools and adds codeql to PATH). Consider adding an explicit tool setup step in each parallel job (and pinning the tools version) so the example doesn’t depend on runner image defaults or risk CLI/database version mismatches.

Copilot uses AI. Check for mistakes.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants