From da3a7ea9f20737817f53bf9acbe9030f8ce895b3 Mon Sep 17 00:00:00 2001 From: Vincent Paturet Date: Mon, 12 Oct 2026 14:14:49 +0200 Subject: [PATCH] ci: ignore HTML-only files in CodeQL scan [ci skip] The shared entur/gha-security code-scan workflow maps .htm/.html files to the javascript-typescript CodeQL language. This repository only has the two bundled SIRI example index.htm files and no JavaScript or TypeScript, so since CodeQL 2.23.5 the javascript-typescript job fails with "CodeQL detected code written in Java/Kotlin, GitHub Actions and HTML, but not any written in JavaScript/TypeScript" (github/codeql#21048). The weekly master scan has failed this way since April 2026 and it also fails on every PR. Setting ignore_language to html makes the shared workflow drop the javascript-typescript matrix entry when the scan would be HTML-only, as documented in gha-security README-code-scan.md. The java and actions scans are unchanged. --- .github/workflows/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 372e4b0..1c5646b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,3 +18,4 @@ jobs: uses: entur/gha-security/.github/workflows/code-scan.yml@v2 with: java_version: "25" + ignore_language: "html"