CodeQL detected code written in `some language`, but not any written in GitHub Actions. Confirm that there is some source code for GitHub Actions in the project.

[jyio-va]

While investigating another problem involving CodeQL, I switched from the default setup to the advanced setup. This resulted in the creation of a .github/workflows/codeql.yml.

Later, I switched back to the default setup, but found it impossible to push a commit that removed the codeql.yml because

Error: Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.22.1/x64/codeql/codeql database finalize --finalize-dataset --threads=8 --ram=29878 /home/runner/work/_temp/codeql_databases/actions". Exit code was 32 and last log line was: CodeQL detected code written in JavaScript/TypeScript, but not any written in GitHub Actions. Confirm that there is some source code for GitHub Actions in the project. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build . See the logs for more details.

Look, I don't want to confirm that there is some source code for GitHub Actions. I want to reassure CodeQL that there is no source code for GitHub Actions and everything is A-OK. Based on the troubleshooting guide, I set strategy.matrix.language to ['javascript-typescript'], but of course this had no effect because CodeQL was now operating in default mode and ignoring the configuration.

Switching back to advanced mode should work, right? Nope, it tried to create another codeql.yml, and that failed because

There was an error committing your changes: A file with the same name already exists. Please choose a different name and try again.

Now CodeQL is not working at all, so there's no way to merge anything into the main branch.

What's the right way to remove codeql.yml and reset CodeQL to default mode? How would one rescue this seemingly broken CodeQL setup?

[rvermeulen]

Hi @jyio-va,

Thanks for your question. Let me reachout internally to determine the best course of action. Stay tuned!

[rvermeulen]

Hi @jyio-va,

Can you update the config for default setup at /:owner/:repo/settings/code-scanning/default-setup and disable analysis for Actions?

[jyio-va]

Thank you @rvermeulen. That did the trick†! Was this link on one of the settings pages? I'd be embarrassed if I missed it 😅

†It was a bit more complicated than that. The configuration change triggered another CodeQL Setup action, and the action succeeded. All checks passed on the pull request, but "Merging is blocked" because "Code scanning is still expecting 1 result from CodeQL for xxxxxxx or yyyyyyy." I then disabled analysis for the other language, JavaScript/TypeScript, and this resulted in "No conflicts with base branch" so "Merging can be performed automatically." This seems to be reproducible: re-enabling JavaScript/TypeScript while keeping GitHub Actions disabled would block merging. The CodeQL scan after merging and re-enabling JavaScript/TypeScript analysis did not report any additional alerts.

[rvermeulen]

@jyio-va that is good to hear. It is on the settings page, but it might not be that discoverable. You view the CodeQL configuration (even when default setup is configured) and that shows an edit button that brings you to the above link.

When you encounter the above Merging is blocked message, are there multiple configurations in :owner/:repo/security/code-scanning/tools/CodeQL/status/configurations/automatic including one for Actions?