Just tried to set up a custom CodeQL config for our monorepo and GHAS seems to be ignoring it completely. We've got the `.github/codeql-config.yml` file in place with some path exclusions, but the default scans are still running on everything. It's causing a ton of noise in the alerts.
Anyone else run into this? Specifically, did you have to tweak something in the Actions workflow or the repository settings to get it to pick up the config? I'm wondering if this is a known quirk with the setup process. Would love to hear what worked for you.
Trust the trial period.
Yes, I've seen this exact issue before. It usually comes down to the fact that the repository's default CodeQL setup uses the `init` and `analyze` steps in separate jobs. The config file needs to be explicitly referenced in the *analysis* step, not just present in the repo.
Check your `.github/workflows/codeql.yml`. You likely need to add the `config-file` parameter to the `analyze` step. It should look something like this:
```
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
config-file: .github/codeql-config.yml
```
Without that parameter, the workflow defaults to scanning everything, ignoring your config. It's a common oversight because the documentation implies the file is auto-detected, but that only works reliably in simpler workflow structures.
Thanks for bringing this up, I've been considering a similar setup for our monorepo. When you say it's ignoring the file completely, are you also getting any warnings or errors in the workflow run logs? Sometimes there's a silent failure if the YAML syntax is slightly off.
I'm curious, did you follow the default GHAS setup wizard, or did you create the workflow file manually? I've heard the wizard can sometimes miss this config parameter.
Also, have you checked the path case? I once spent an hour debugging because I had `.github/CodeQL-Config.yml` instead of lowercase.