Petition to exempt `copilot-sdk` from CodeQL-Block

[edburns]

Commits related to issue #1443 introduce a codeql.yml file that implements per-language Code QL targeting.

However, it appears there is additional Org-mandated dynamic scanning that is now redundant.

See this comment for an explanation.

Ask an org admin to exempt copilot-sdk from CodeQL-Block since you already have a custom codeql.yml that covers all 7 languages (including rust and actions which the dynamic scanning doesn't even cover). This is the ideal fix — it removes the 5 redundant full-analysis jobs.

[github-actions]

Thanks for opening this issue! Unfortunately, this couldn't be automatically classified into one of the standard categories (bug, enhancement, question, or documentation).

This appears to be an infrastructure/org-policy request (exempting the repo from CodeQL-Block), which requires action from an org admin and doesn't fit the standard SDK issue workflows. A human maintainer will need to review and handle this directly.

Generated by Issue Classification Agent for issue #1511 · ● 859.3K · ◷

[edburns]

Slack link.

[edburns]

@mrecachinas wrote at  [5:55 PM]

This might be a question for both #code-scanning as well as #prodsec-engineering-team:

• #code-scanning because I'm surprised CodeQL is running on unchanged files in the PR. It shouldn't be, so I would love to understand if this is the right behavior there.
• #prodsec-engineering because they're the owners of the github org's GHAS enablement/enforcement and they own the PR blocking enforcement.

[edburns]

I will take this over to those two channels, but to this point

I'm surprised CodeQL is running on unchanged files in the PR. It shouldn't be, so I would love to understand if this is the right behavior there.

Note that this PR #1561 had 0 changed files but ran the automatic CodeQL (5 languages) and my custom ones (7 languages, all skipped)

[edburns]

I suggest that I select one of those two channels as the primary venue for this discussion and make a link to the discussion from the other one.

[edburns]

Text to post to code-scanning

Slack link.

Subject: Petition to exempt copilot-sdk from CodeQL-Block

Commits related to issue Copilot SDK #1443 introduce a codeql.yml file that implements per-language Code QL targeting.

However, it appears there is additional org-mandated dynamic scanning for five languages that is now redundant. But there appears to be no in-repo way to turn off the org-mandated dynamic scanning.

See this comment for an explanation.

Ask an org admin to exempt copilot-sdk from CodeQL-Block since you already have a custom codeql.yml that covers all 7 languages (including rust and actions which the dynamic scanning doesn't even cover). This is the ideal fix — it removes the 5 redundant full-analysis jobs.

I was helpfully directed to this channel by @mrecachinas .

I am tracking this issue at Copilot SDK #1511.

mrecachinas observed:

I'm surprised CodeQL is running on unchanged files in the PR. It shouldn't be, so I would love to understand if this is the right behavior there.

And I further observed:

Note that this PR #1561 had 0 changed files but ran the automatic CodeQL (5 languages) and my custom ones (7 languages, all skipped).