Repository navigation
Ignore HTML-only files in CodeQL scan - #41
Merged
Merged
Conversation
vpaturet
changed the title
The shared entur/gha-security code-scan workflow maps .htm/.html files to the javascript-typescript CodeQL language. This repository only has the two bundled SIRI example index.htm files and no JavaScript or TypeScript, so since CodeQL 2.23.5 the javascript-typescript job fails with "CodeQL detected code written in Java/Kotlin, GitHub Actions and HTML, but not any written in JavaScript/TypeScript" (github/codeql#21048). The weekly master scan has failed this way since April 2026 and it also fails on every PR. Setting ignore_language to html makes the shared workflow drop the javascript-typescript matrix entry when the scan would be HTML-only, as documented in gha-security README-code-scan.md. The java and actions scans are unchanged.
vpaturet
force-pushed
the
fix/codeql-ignore-html
branch
from
October 12, 2026 12:27
d7d21f3 to
da3a7ea
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Code Scan / codeql-analysis (javascript-typescript)job fails on every PR and on the weekly scheduled run onmaster(failing since April 2026):The shared
entur/gha-securitycode-scan workflow derives the CodeQL language matrix from file extensions and maps.htm/.htmltojavascript-typescript. This repository only contains the two bundled SIRI example filessrc/main/resources/siri-2.0/examples/index.htmandsrc/main/resources/siri-2.1/examples/index.htm, with no JavaScript or TypeScript. Since CodeQL 2.23.5 the JavaScript extractor refuses to finalize a database with no JS/TS source (github/codeql#21048).Fix
Pass
ignore_language: "html"to the shared workflow, as documented in its README. The language detector then drops thejavascript-typescriptmatrix entry when the scan would be HTML-only. Thejavaandactionsscans are unchanged.Example of a failing run: https://github.com/entur/siri-java-model/actions/runs/38245521102