Fix CodeQL workflow: override TargetFrameworks to prevent iOS workload errors on Ubuntu - #463
Merged
Merged
Conversation
The custom CodeQL workflow was manually disabled in GitHub Actions UI. A disabled workflow cannot be re-enabled through code changes alone. Renaming the file creates a new active workflow, fixing code scanning. Also improved workflow robustness: - Added android workload installation - Added explicit dotnet restore step - Added DOTNET_NOLOGO and related env vars - Used --no-restore flag on build step Agent-Logs-Url: https://github.com/trimble-oss/modus-mobile-maui-components/sessions/e79135d3-6596-4540-9a4c-01b6806b0010 Co-authored-by: jeff-at-trimble <215895768+jeff-at-trimble@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Investigate and propose fix for CodeQL scanning issue
Fix CodeQL scanning by replacing manually disabled workflow
Mar 26, 2026
coliff
previously approved these changes
Mar 26, 2026
There was a problem hiding this comment.
Pull request overview
Restores reliable CodeQL scanning by replacing a manually-disabled workflow with a newly-registered workflow file and aligning the build steps with the repository’s CI approach.
Changes:
- Replaced the disabled CodeQL workflow by introducing
.github/workflows/codeql-analysis.yml(new workflow path). - Updated CodeQL build steps to install required workloads, run
dotnet restore, and build with--no-restore. - Updated
CODE_SCANNING_SETUP.mdto document the root cause (manually-disabled workflow) and the new workflow filename.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| CODE_SCANNING_SETUP.md | Updates documentation to reflect the new workflow file and guidance around duplicate configurations. |
| .github/workflows/codeql-analysis.yml | Adds a new CodeQL workflow with explicit .NET MAUI build steps for CodeQL analysis. |
Comments suppressed due to low confidence (3)
.github/workflows/codeql-analysis.yml:26
- The job-level condition
if: github.actor != 'dependabot[bot]'means CodeQL will never run on Dependabot PRs, so dependency update PRs won’t get CodeQL results/alerts until after merge (via push/schedule). If the skip is required due to token permission limits, consider documenting that inCODE_SCANNING_SETUP.md; otherwise consider removing the condition so PR scanning remains consistent for all contributors.
.github/workflows/codeql-analysis.yml:43 actions/setup-dotnethere doesn’t match the CI workflow: CI setsinclude-prerelease: truefordotnet-version: 9.0.x. If this repo still relies on preview SDK builds, CodeQL will start failing to install the requested SDK on runners without prerelease enabled. Consider aligning with CI by addinginclude-prerelease: true(or pinning the exact SDK viaglobal.json).
.github/workflows/codeql-analysis.yml:47- This workflow builds
net9.0-androidbut doesn’t pin/install a JDK, while the CI workflow explicitly installs Java 11. Relying on whatever Java happens to be preinstalled onubuntu-latestcan make the CodeQL build fragile when runner images change. Add anactions/setup-java@v4step (matching CI) before installing workloads/building.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ubuntu-latest has .NET 10.0.201 pre-installed. The dotnet CLI picks the highest SDK, causing NETSDK1178 errors because MAUI workloads installed for .NET 9 are incompatible with .NET 10. global.json with rollForward:latestFeature pins to 9.0.xxx. Agent-Logs-Url: https://github.com/trimble-oss/modus-mobile-maui-components/sessions/5b154b20-f9c6-438d-a543-4e9d4d4c4b1a Co-authored-by: jeff-at-trimble <215895768+jeff-at-trimble@users.noreply.github.com>
Copilot
AI
changed the title
Fix CodeQL scanning by replacing manually disabled workflow
Fix CodeQL code scanning: re-enable disabled workflow and pin .NET SDK version
Mar 26, 2026
coliff
self-requested a review
March 26, 2026 15:59
coliff
previously approved these changes
Mar 26, 2026
The separate `dotnet restore Trimble.Modus.Components.sln` step restores ALL target frameworks (including ios/maccatalyst) which aren't available on Ubuntu. Removing it and letting `dotnet build -f net9.0-android` handle both restore and build scopes everything to android only. Agent-Logs-Url: https://github.com/trimble-oss/modus-mobile-maui-components/sessions/d85990fa-e435-43f7-9ecc-571eb3329b92 Co-authored-by: jeff-at-trimble <215895768+jeff-at-trimble@users.noreply.github.com>
Copilot
AI
changed the title
Fix CodeQL code scanning: re-enable disabled workflow and pin .NET SDK version
Fix CodeQL workflow: pin .NET SDK and scope restore to android-only
Mar 26, 2026
…QL build Using -f net9.0-android doesn't prevent MSBuild from evaluating and importing workloads for ALL declared TargetFrameworks (including ios and maccatalyst) during project SDK evaluation. This happens before the framework selector takes effect. Using /p:TargetFrameworks=net9.0-android overrides the property at the command-line level (highest MSBuild priority), so the SDK only sees net9.0-android during evaluation and doesn't try to import unavailable iOS/macCatalyst workloads. Also build only the library project instead of the full solution, since DemoApp code isn't needed for CodeQL security analysis. Agent-Logs-Url: https://github.com/trimble-oss/modus-mobile-maui-components/sessions/bcc76a04-3fd6-4b59-beb1-97abd429b4af Co-authored-by: jeff-at-trimble <215895768+jeff-at-trimble@users.noreply.github.com>
Copilot
AI
changed the title
Fix CodeQL workflow: pin .NET SDK and scope restore to android-only
Fix CodeQL workflow: override TargetFrameworks to prevent iOS workload errors on Ubuntu
Mar 26, 2026
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeQL CI has been failing on
ubuntu-latestdue to three layered issues, each masking the next.Changes
codeql.yml→codeql-analysis.yml— workflow was disabled via GitHub Actions UI; disabled state is keyed by file pathglobal.json—ubuntu-latestnow ships .NET 10.0 pre-installed, which gets selected over 9.0. Pin to9.0.xwithrollForward: latestFeature/p:TargetFrameworks=net9.0-androidinstead of-f net9.0-android— the core fix.-fsetsTargetFrameworkfor the inner build after project evaluation, butMicrosoft.NET.Sdk.ImportWorkloads.targetsruns during evaluation for ALL frameworks inTargetFrameworks./p:TargetFrameworks=overrides at MSBuild's command-line priority, so the SDK never seesnet9.0-ios/net9.0-maccatalyst📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.