From ed0434b325f7808e0e3d2b6af7d4293831660ddd Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Fri, 18 Sep 2026 17:39:10 +0300 Subject: [PATCH] Run the CodeQL security-and-quality suite security-extended carries no rule scored below medium and no note-level rule across the four analysed languages, so the low and note tiers of Code scanning stayed empty by construction. The quality packs add the maintainability and reliability queries that fill them. --- .github/workflows/codeql.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0160491eb2..6a650cde62 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -79,7 +79,11 @@ jobs: with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - queries: security-extended + # security-and-quality = security-extended plus the maintainability and + # reliability queries. The security packs alone carry no rule scored + # below "medium" and no note-level rule, so this is the only way the + # low/note tiers of the Security tab ever get populated. + queries: security-and-quality # Exclude test and integration-test sources. With build-mode 'none' # CodeQL extracts straight from source, so paths-ignore reliably # scopes the analysis (it is honored for compiled languages only when