ci(codeql): replace default setup with an advanced workflow so required checks report - #102
Merged
Merged
Conversation
…ed checks report The `main` ruleset requires the status checks `Analyze (actions)` and `Analyze (javascript-typescript)`, but those check runs were produced by CodeQL *default* setup, which "does not run on pull requests from forks". On any fork PR the checks were therefore never created at all, and a required check that is never reported sits at "Expected - Waiting for status to be reported" indefinitely with no way to clear it. Observed on #97 (fork) and #99 (Dependabot): neither head SHA has a CodeQL workflow run of any kind. The "N configurations present on refs/heads/main were not found" warning on the results check is the same fault seen from the other side: `main` has a baseline analysis for `/language:actions` and `/language:javascript-typescript`, the PR has neither, so code scanning cannot diff them and cannot attribute alerts to the pull request. Advanced setup fixes both because it is an ordinary `pull_request` workflow. It runs for forks and for Dependabot, and code scanning permits SARIF upload from `pull_request`-triggered runs even under a read-only token. The job name renders exactly `Analyze (actions)` and `Analyze (javascript-typescript)`, so the existing ruleset contexts keep resolving and no ruleset edit is needed; `category` stays `/language:<language>` so analyses keep the category keys the default-setup baseline used and PR-vs-base comparison survives the switch. Both languages are interpreted, so `build-mode: none`. Actions are SHA-pinned with a trailing version comment to match the other workflows and to stay in Dependabot's `github-actions` group. Default setup must stay disabled: re-enabling it disables this workflow and blocks its uploads. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Replaces CodeQL default setup with an advanced workflow so required security checks run for fork and Dependabot PRs.
Changes:
- Adds pull request, main-branch push, and weekly CodeQL scans.
- Preserves required check names and baseline categories.
- Uses least-privilege permissions and SHA-pinned actions.
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Two symptoms, one root cause.
1. Required checks never report. The
mainruleset requires the status checksAnalyze (actions)andAnalyze (javascript-typescript). Those check runs came from CodeQL default setup, which GitHub documents as running on pull requests against the default branch "excluding pull requests from forks." When default setup doesn't run, the check runs are never created, and a required check that is never reported sits atExpected — Waiting for status to be reportedforever. There is no way to clear it, so the PR is permanently blocked.Observed on the current corpus — neither head SHA has a CodeQL workflow run of any kind:
aballiet)2.
2 configurations not found. The same fault seen from the other side.mainhas a baseline analysis for/language:actionsand/language:javascript-typescript; the PR has neither, so code scanning cannot diff them and reports that it "cannot determine the alerts introduced by this pull request."Requiring the
CodeQLresults check instead would not have helped — on the fork PR that check is absent too. Default setup fundamentally cannot back a required check on a repository that takes fork PRs.Fix
Replace default setup with advanced setup: a committed
.github/workflows/codeql.yml. Because it is an ordinarypull_requestworkflow it runs for forks and for Dependabot, and code scanning permits SARIF upload frompull_request-triggered runs even under a read-only token.Two details are load-bearing:
Analyze (actions)andAnalyze (javascript-typescript), so the existing ruleset contexts keep resolving. No ruleset edit is required. Renaming the job or a matrix language silently reintroduces the permanently-pending check.categorystays/language:<language>, matching the category keys the default-setup baseline used, so PR-vs-base alert comparison survives the switch.Both languages are interpreted, so
build-mode: none. Actions are SHA-pinned with a trailing version comment to matchci.ymland to stay in Dependabot'sgithub-actionsgroup. A weekly cron preserves the baseline cadence default setup had.Repository setting changed
Default setup and advanced setup are mutually exclusive — default setup "disables any existing CodeQL workflows, and blocks any CodeQL analysis API uploads." It has been set to
not-configuredviaPATCH /repos/mbeacom/adrkit/code-scanning/default-setup.Verification
Rung 1 of the ADR-0014 ladder is this PR itself: the two required checks must move off
Expectedand report a real conclusion. That is the behavior that was broken, observed directly.Note that until this lands on
main, the results check may still warn about stale default-setup configurations, which have a differentanalysis_key(dynamic/github-code-scanning/codeql:analyze) than this workflow's. That clears oncemainhas a baseline from this workflow; any leftover stale configurations get deleted afterwards.