fix(ci): replace default CodeQL with custom workflow to unblock CI

[jquinter]

Summary

• The default CodeQL Python analysis takes 49+ minutes and fails — 2 queries produce result sets exceeding 2 GiB:
  • py/clear-text-logging-sensitive-data (CWE-312) — 38m51s
  • py/polynomial-redos (CWE-730) — 45m24s
• This consumes a full runner slot and blocks CI pipeline resources
• Adds a custom CodeQL workflow with:
  • 30-minute timeout (hard cap instead of unlimited)
  • Concurrency group with cancel-in-progress: true to prevent piling up
  • Query exclusions for the 2 problematic queries via .github/codeql/codeql-config.yml
  • Path ignores for tests/, docs/, **/*.md, and UI build output
  • Same 4 languages as the current default setup: actions, javascript-typescript, python, ruby

Before merging

Important: Disable the Default Setup in repo Settings > Code security > Code scanning before merging. Otherwise both the default and custom workflows will run simultaneously, doubling resource usage.

Test plan

• Disable Default Setup in repo settings
• Merge this PR
• Verify CodeQL runs complete in <15 minutes with the custom config
• Verify security alerts still appear for the remaining 43 Python queries

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Feb 28, 2026 3:18pm

[greptile-apps]

Greptile Summary

Adds a custom CodeQL workflow (.github/workflows/codeql.yml) and config (.github/codeql/codeql-config.yml) to replace the default CodeQL setup that was timing out after 49+ minutes due to two Python queries producing >2 GiB result sets.

• Excludes py/clear-text-logging-sensitive-data (CWE-312) and py/polynomial-redos (CWE-730) queries that cause timeouts
• Adds a 30-minute hard timeout and concurrency group with cancel-in-progress to prevent resource piling
• Ignores tests/, docs/, **/*.md, and UI build output paths
• Covers the same 4 languages as the default setup: actions, javascript-typescript, python, ruby
• Important: The PR description notes that the Default Setup must be disabled in repo settings before merging to avoid duplicate runs

Confidence Score: 4/5

• This PR is safe to merge — it adds CI configuration only with no runtime code changes, though the concurrency group behavior on main merits attention.
• Score of 4 reflects that the workflow and config are well-structured with correct syntax and sensible defaults. The only concern is the concurrency group potentially cancelling security scans on the main branch during rapid merge sequences. No runtime code is affected.
• .github/workflows/codeql.yml — review the concurrency group behavior for pushes to main

Important Files Changed

Filename	Overview
.github/codeql/codeql-config.yml	New CodeQL config that excludes two problematic Python queries (CWE-312, CWE-730) that produce >2 GiB result sets, and ignores tests/docs/markdown/UI output paths. Syntax is correct.
.github/workflows/codeql.yml	New CodeQL workflow with 30-min timeout, concurrency group with cancel-in-progress, matrix strategy for 4 languages. Well-structured but concurrency group may cancel in-progress scans on pushes to main.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push to main / PR to main / Weekly schedule] --> B[Concurrency check]
    B -->|Cancel previous run| C[Matrix: 4 language jobs]
    C --> D1[actions - build-mode: none]
    C --> D2[javascript-typescript - build-mode: none]
    C --> D3[python - build-mode: none]
    C --> D4[ruby - build-mode: none]
    D1 --> E1[Checkout → Init CodeQL → Analyze]
    D2 --> E2[Checkout → Init CodeQL → Analyze]
    D3 --> E3[Checkout → Init CodeQL → Analyze]
    D4 --> E4[Checkout → Init CodeQL → Analyze]
    E1 --> F[Upload SARIF results]
    E2 --> F
    E3 --> F
    E4 --> F
    subgraph Config [codeql-config.yml]
        G[Exclude py/clear-text-logging-sensitive-data]
        H[Exclude py/polynomial-redos]
        I[Ignore: tests, docs, *.md, UI output]
    end
    E3 -.->|applies to| Config

Loading

_{Last reviewed commit: 53f3123}

[greptile-apps]

_{2 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}