Run CodeQL analysis (javascript) on a particular sub-directory in a repo

[vc-lijup-nandana]

I have a repo with many microservices each will have separate CI pipeline in the same repo. I need to scan each microservices separately, which are in separate directory.

I tried following code

name: 'CI - Demo Job - Bing'

on:
  workflow_dispatch:
  push:
    paths:
      - 'app1/services/microservice1'
   
jobs:
  sast:
    name: Static Application Security Testing (SAST)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code into subdirectory
        uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Fetch all history for accurate path filtering
          path: 'app1/services/microservice1'  # Specify the directory to checkout

      # Continue with your CodeQL setup and analysis steps
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript
          queries: security-extended,security-and-quality

      - name: Javascript Autobuild
        uses: github/codeql-action/autobuild@v2 

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
        with:
          category: "/language:javascript"

But this is scanning the entire repo and services not only limited to microservice1

[aeisenberg]

You need to create a code scanning configuration file and specify a paths option that tells CodeQL which paths to include in the database.

And then you also need to change the category: "/language:javascript" option so that it is unique to the subdirectory you are working on. See the docs on categories.

[devhorizon999]

I think the missing piece is that the on.push.paths filter only controls when the workflow runs. It does not limit what CodeQL analyzes once the workflow has started.

To restrict the actual CodeQL analysis to one microservice, add a CodeQL config file and use paths there.

For example:

# .github/codeql/codeql-microservice1.yml
name: "CodeQL config - microservice1"

paths:
  - app1/services/microservice1

[airshakur88]

The key distinction is analysis scope vs. workflow scheduling: on.push.paths controls when the workflow runs, and actions/checkout path controls where the checkout lands. Neither restricts the files CodeQL analyzes.

For a per-service scan, put the allowlist in a CodeQL config and pass it to init:

# .github/codeql/microservice1.yml
paths:
  - app1/services/microservice1/**

- uses: github/codeql-action/init@v3
  with:
    languages: javascript
    config-file: ./.github/codeql/microservice1.yml
- uses: github/codeql-action/analyze@v3
  with:
    category: /language:javascript/microservice1

Use a distinct category for each service so the analyses remain separate. One correction to the defaults.run.working-directory suggestion above: GitHub applies that setting only to run steps, not to uses: github/codeql-action/autobuild. If a custom build must run inside the service folder, use a run step with its own working-directory (or build manually).

Docs: CodeQL paths, analysis categories, defaults.run.working-directory.