Enhance overview of parallelizing CodeQL analysis#72
Conversation
Clarified the overview section and improved the explanation of the benefits of parallelizing MISRA analysis.
There was a problem hiding this comment.
Pull request overview
Adds a new guide explaining how to parallelize CodeQL analysis (focused on MISRA C / MISRA C++) by separating database creation from query execution and fanning out analysis across multiple GitHub Actions jobs.
Changes:
- Introduces a new documentation page describing the
skip-queriespattern to build once and analyze in parallel. - Provides a full workflow example (build DB → upload artifact → parallel MISRA analyses → SARIF uploads).
- Documents key considerations (categories, artifact sizing, version pinning, limitations).
|
|
||
| By default, the CodeQL Action builds a database and runs queries sequentially in a single job. | ||
|
|
||
| We will use an example safety-critical codebases that must comply with **MISRA C** and **MISRA C++** standards, running both rule sets sequentially can result in long-running workflows. You can **decouple database creation from query execution** using the [`skip-queries`](https://github.com/github/codeql-action/blob/main/analyze/action.yml#L39-L40) input, then fan out MISRA analysis across parallel jobs using GitHub Actions artifacts. |
There was a problem hiding this comment.
The overview sentence has a grammatical error and is hard to parse (“an example safety-critical codebases…”). Consider rewriting to singular “codebase” (or “example of a safety-critical codebase”) and splitting into two sentences for readability.
| We will use an example safety-critical codebases that must comply with **MISRA C** and **MISRA C++** standards, running both rule sets sequentially can result in long-running workflows. You can **decouple database creation from query execution** using the [`skip-queries`](https://github.com/github/codeql-action/blob/main/analyze/action.yml#L39-L40) input, then fan out MISRA analysis across parallel jobs using GitHub Actions artifacts. | |
| We will use an example of a safety-critical codebase that must comply with **MISRA C** and **MISRA C++** standards. Running both rule sets sequentially can result in long-running workflows. You can **decouple database creation from query execution** using the [`skip-queries`](https://github.com/github/codeql-action/blob/main/analyze/action.yml#L39-L40) input, then fan out MISRA analysis across parallel jobs using GitHub Actions artifacts. |
| When set to `"true"`, the action: | ||
|
|
There was a problem hiding this comment.
Inline code is rendering escaped quotes (\"true\"). In Markdown you can write this as "true" without backslashes (or just true), otherwise the backslashes will appear in the rendered doc.
| outputs: | ||
| db-locations: ${{ steps.analyze.outputs.db-locations }} |
There was a problem hiding this comment.
build-db publishes an outputs.db-locations, but the workflow never uses it. Either remove this output to reduce confusion, or show how downstream jobs can consume it (for example, to set the artifact path or to avoid hard-coding the database directory).
| outputs: | |
| db-locations: ${{ steps.analyze.outputs.db-locations }} |
|
|
||
| ### Using `if: always()` on SARIF Upload | ||
|
|
||
| The `upload-sarif` step uses `if: always()` so that even if the analysis step finds violations and returns a non-zero exit code, the SARIF file is still uploaded. This ensures you always see results in Code Scanning. |
There was a problem hiding this comment.
The note about if: always() is misleading: CodeQL analysis typically does not exit non-zero just because it found alerts/violations; non-zero is more commonly due to execution errors. Suggest rewording to “even if the analysis command fails” (or documenting --fail-on/equivalent if you intend to fail the job on findings).
| The `upload-sarif` step uses `if: always()` so that even if the analysis step finds violations and returns a non-zero exit code, the SARIF file is still uploaded. This ensures you always see results in Code Scanning. | |
| The `upload-sarif` step uses `if: always()` so that even if the analysis command fails (for example, due to an internal error or because you have configured it to fail on findings), the SARIF file is still uploaded. This ensures you always see results in Code Scanning. |
| ### CodeQL CLI Availability | ||
|
|
||
| The `codeql` CLI is pre-installed on all GitHub-hosted runners and is already on the `PATH`. You do not need to run the `init` action in the parallel jobs — just use `codeql` directly. | ||
|
|
There was a problem hiding this comment.
The workflow relies on codeql being available in the MISRA fan-out jobs, but those jobs never run github/codeql-action/init (which is what typically downloads/pins the CodeQL tools and adds codeql to PATH). Consider adding an explicit tool setup step in each parallel job (and pinning the tools version) so the example doesn’t depend on runner image defaults or risk CLI/database version mismatches.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Clarified the overview section and improved the explanation of the benefits of parallelizing MISRA analysis.