Run CodeQL analysis (javascript) on a particular sub-directory in a repo

[vc-lijup-nandana]

I have a repo with many microservices each will have separate CI pipeline in the same repo. I need to scan each microservices separately, which are in separate directory.

I tried following code

name: 'CI - Demo Job - Bing'

on:
  workflow_dispatch:
  push:
    paths:
      - 'app1/services/microservice1'
   
jobs:
  sast:
    name: Static Application Security Testing (SAST)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code into subdirectory
        uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Fetch all history for accurate path filtering
          path: 'app1/services/microservice1'  # Specify the directory to checkout

      # Continue with your CodeQL setup and analysis steps
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript
          queries: security-extended,security-and-quality

      - name: Javascript Autobuild
        uses: github/codeql-action/autobuild@v2 

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
        with:
          category: "/language:javascript"

But this is scanning the entire repo and services not only limited to microservice1

[aeisenberg]

You need to create a code scanning configuration file and specify a paths option that tells CodeQL which paths to include in the database.

And then you also need to change the category: "/language:javascript" option so that it is unique to the subdirectory you are working on. See the docs on categories.

[devhorizon999]

I think the missing piece is that the on.push.paths filter only controls when the workflow runs. It does not limit what CodeQL analyzes once the workflow has started.

To restrict the actual CodeQL analysis to one microservice, add a CodeQL config file and use paths there.

For example:

# .github/codeql/codeql-microservice1.yml
name: "CodeQL config - microservice1"

paths:
  - app1/services/microservice1