Skip to content

CODEQL_WARNINGS_GUIDE.md

Latest commit

 

History

History
100 lines (78 loc) · 3.46 KB

CODEQL_WARNINGS_GUIDE.md

File metadata and controls

100 lines (78 loc) · 3.46 KB
Raw

CodeQL Warnings Guide

This document explains common CodeQL workflow warnings and how to interpret them.

⚠️ Common Warnings (These are NOT failures)

1. "Unable to write summary to pull-request"

Status: ⚠️ Warning (Not a failure)
Cause: Workflow permissions or repository settings
Impact: CodeQL analysis still runs, but PR comments may not be posted

Solutions:

  • ✅ Already implemented: Workflow has pull-requests: write permission
  • ✅ Already implemented: Additional permissions added for comprehensive access
  • 🔍 Check: Repository settings → Actions → General → Workflow permissions
  • 🔍 Check: If running from a fork, permissions are limited by GitHub security

2. "Cannot create diff range extension pack for diff-informed queries"

Status: ℹ️ Informational (Not a failure)
Cause: Large number of changed files (>300) in pull request
Impact: CodeQL performs full analysis instead of optimized diff analysis
Result: ✅ Analysis still completes successfully - just takes longer

Why this happens:

  • Diff-based analysis is an optimization for smaller changesets
  • When too many files change, CodeQL falls back to full analysis
  • This is by design and not an error

3. "Cannot retrieve the full diff because there are too many changed files"

Status: ℹ️ Informational (Not a failure)
Cause: Same as #2 - large changeset
Impact: Same as #2 - full analysis instead of diff analysis
Result: ✅ Analysis still works perfectly

✅ What Our Workflow Does

Enhanced Permissions:

permissions:
  actions: read
  contents: read
  security-events: write
  pull-requests: write
  issues: write
  repository-projects: read
  statuses: write

Better Diff Handling:

  • Fetches full git history (fetch-depth: 0)
  • Checks changeset size and provides informative messages
  • Continues analysis regardless of diff optimization availability

Error Resilience:

  • Uploads results even with warnings
  • Provides clear messaging about what's happening
  • Distinguishes between actual failures and informational messages

🎯 Expected Behavior

Small Pull Requests (<300 files):

  • ✅ Diff-based analysis (faster)
  • ✅ All optimizations active
  • ✅ PR comments posted

Large Pull Requests (>300 files):

  • ⚠️ Warning messages about diff analysis (expected)
  • ✅ Full analysis performed (slower but complete)
  • ✅ All security issues detected
  • ✅ Results uploaded successfully

🔧 Troubleshooting

If PR comments aren't posted:

  1. Check repository Settings → Actions → General
  2. Ensure "Read and write permissions" is selected
  3. Verify workflow has pull-requests: write permission ✅ (already set)

If analysis fails completely:

  1. Check for actual error messages (not warnings)
  2. Review CodeQL configuration syntax
  3. Verify paths in .github/codeql/codeql-config.yml

📊 Success Indicators

✅ CodeQL is working correctly if you see:

  • Security analysis completes
  • Results uploaded to GitHub Security tab
  • No actual error messages (warnings are OK)
  • Security issues detected and reported

❌ Actual problems would show as:

  • Workflow fails completely
  • No results uploaded
  • Configuration syntax errors
  • Build failures

Summary: The warnings you're seeing are normal and expected for large changesets. CodeQL is working correctly and providing comprehensive security analysis.