Add opt-in changed-files input to narrow CodeQL language matrix to touched languages

[Copilot]

CodeQL currently scans every language detected in the repo on every PR, even when the diff only touches one of them (e.g. an index.js change still triggers a full Python scan). This wastes CI time on slower language scans that have nothing to review.

Changes

• New changed-files input (action.yml → entrypoint.sh → main.py): optional, defaults to unset so existing "scan everything" behavior is unchanged unless explicitly opted into.
• Extension-based filtering (main.py):
  • parse_changed_files() accepts a JSON array or a comma/newline/space-separated list (compatible with git diff --name-only or tj-actions/changed-files output).
  • filter_by_changed_files() maps changed file extensions to CodeQL language slugs and narrows the matrix to only those languages, applied after exclude_languages() so excluded languages can't be reintroduced.
  • Correctly handles legacy combined slugs, javascript includes TypeScript files and java includes Kotlin files when standard-language-names is off, mirroring how build_languages_list() already folds those languages together.
  • actions only matches files under .github/workflows/.
• README: documents the new input, and calls out that skipping languages can leave required status checks/rulesets permanently unsatisfied for those categories. Recommends pairing this with monorepo-code-scanning-action's republish-sarif step to keep required checks green for skipped languages; that action's github-script-based, project-config-driven design means it can't be invoked directly from within this Docker action, so it's documented as a complementary workflow step rather than integrated in code.

Example

- name: Get changed files
  id: changed-files
  run: echo "files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | tr '\n' ',')" >> "$GITHUB_OUTPUT"

- name: Get languages from repo
  id: set-matrix
  uses: advanced-security/set-codeql-language-matrix@v1
  with:
    access-token: ${{ secrets.GITHUB_TOKEN }}
    endpoint: ${{ github.event.repository.languages_url }}
    changed-files: ${{ steps.changed-files.outputs.files }}

• Fixes Set matrix based on changed file types #6

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Review details

Suppressed comments (2)

main.py:128

• The actions language filter currently checks for /.github/workflows/ as a substring anywhere in the path. This will incorrectly treat files like foo/.github/workflows/ci.yml as GitHub Actions workflows, even though workflows must live at the repo root under .github/workflows/. Use a strict path-prefix check after normalization.

            if language == "actions" and "/.github/workflows/" not in "/" + file_path:
                continue

README.md:163

• The README states changed-files accepts space-separated paths, but whitespace-delimited formats cannot unambiguously represent filenames that contain spaces (which git diff --name-only can output). Consider documenting this limitation and recommending the JSON array form when paths may contain spaces.

By default, the matrix includes every CodeQL-supported language detected in the repository, even if a given pull request doesn't touch any files in that language. To scan only the languages actually touched by a pull request, pass the list of changed files to the `changed-files` input. It accepts a comma, space, or newline separated list of file paths, or a JSON array (the output formats used by most "changed files" actions).

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

[felickz]

@copilot add a ci.yml to run the tests on push and pr.

[Copilot]

@copilot add a ci.yml to run the tests on push and pr.

Added .github/workflows/ci.yml to run test_main.py on push and pull_request to main.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.