Skip to content
Latchkey
Start Free

codeql-analysis workflow (Hypfer/Valetudo)

The codeql-analysis workflow from Hypfer/Valetudo, explained and optimized by Latchkey.

A

CI health: A - excellent

Run this on Latchkey for self-healing, caching, and up to 58% lower cost.

Grade your own workflow free or run it on Latchkey →
Source: Hypfer/Valetudo.github/workflows/codeql-analysis.ymlLicense Apache-2.0View source

What it does

This is the codeql-analysis workflow from the Hypfer/Valetudo repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)
{
  "name": "CodeQL",
  "on": {
    "push": {
      "branches": [
          "master"
      ]
    },
    "pull_request": {
      "branches": [
          "master"
      ]
    },
    "schedule": [
      {
        "cron": "24 17 * * 5"
      }
    ]
  },
  "jobs": {
    "analyze": {
      "name": "Analyze",
      "runs-on": "ubuntu-latest",
      "strategy": {
        "fail-fast": false,
        "matrix": {
          "language": [
              "javascript"
          ]
        }
      },
      "steps": [
        {
          "name": "Checkout repository",
          "uses": "actions/checkout@v6"
        },
        {
          "name": "Initialize CodeQL",
          "uses": "github/codeql-action/init@v3",
          "with": {
            "languages": "${{ matrix.language }}"
          }
        },
        {
          "name": "Autobuild",
          "uses": "github/codeql-action/autobuild@v3"
        },
        {
          "name": "Perform CodeQL Analysis",
          "uses": "github/codeql-action/analyze@v3"
        }
      ]
    }
  }
}

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

{
  "name": "CodeQL",
  "on": {
    "push": {
      "branches": [
          "master"
      ]
    },
    "pull_request": {
      "branches": [
          "master"
      ]
    },
    "schedule": [
      {
        "cron": "24 17 * * 5"
      }
    ]
  },
  "jobs": {
    "analyze": {
      "name": "Analyze",
      "runs-on": "ubuntu-latest",
      "strategy": {
        "fail-fast": false,
        "matrix": {
          "language": [
              "javascript"
          ]
        }
      },
      "steps": [
        {
          "name": "Checkout repository",
          "uses": "actions/checkout@v6"
        },
        {
          "name": "Initialize CodeQL",
          "uses": "github/codeql-action/init@v3",
          "with": {
            "languages": "${{ matrix.language }}"
          }
        },
        {
          "name": "Autobuild",
          "uses": "github/codeql-action/autobuild@v3"
        },
        {
          "name": "Perform CodeQL Analysis",
          "uses": "github/codeql-action/analyze@v3"
        }
      ]
    }
  }
}
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

What changed

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.