docs(adr): design dispatch+poll architecture to restore central CodeQL - #1772
Merged
Conversation
codeql-pr.yml cannot run codeql-action inside a required workflow (GitHub platform restriction, root-caused in docs/doctoring/codeql-pr-required-workflow-always-fails.md and fixed there by removing it from ruleset 18156473). This ADR designs the follow-up: mirror the strix.yml/opencode-review.yml dispatch+poll pattern so codeql-pr.yml stays required-workflow-safe while the actual codeql-action work runs natively in .github via repository_dispatch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 39 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This was referenced Sep 3, 2026
This was referenced Sep 3, 2026
seonghobae
added a commit
that referenced
this pull request
Sep 3, 2026
…sitive_log (#1808) Skip json.loads() for log lines that obviously can't be JSON (checked via a first-character set), avoiding expensive JSONDecodeError exception handling on large non-JSON CI log files. Scalar JSON values (numbers, true/false/null) still parse successfully but fall through to the unstructured redactor rather than round-tripping through json.dumps, matching existing behavior for those lines. Also fixes a pre-existing bug this change newly exercises: _consume_sensitive_assignment's unquoted-value scanner didn't stop at a bare quote character, so an assignment embedded inside an outer JSON-string literal (e.g. "token=secret123456789") silently swallowed the closing quote into the redacted value, corrupting line structure. Clean rebuild of #1751 (branch bolt/optimize-json-decode-8663451122774961708): that branch's own diff against current main is 91 files / 7805 deletions, including deleting codeql-scan-dispatch.yml and gutting codeql-pr.yml back toward a pre-#1772/#1774/#1776/#1778 state -- its merge-base with main (0c9a5ab) is 12 commits stale and its own in-branch "Merge branch 'main'" commit did not actually pick up main's content correctly. This branch carries forward only #1751's real, intended change (verified against its isolated file diff) rebuilt on current main, plus the one pre-existing bug that change exposed.
seonghobae
added a commit
that referenced
this pull request
Sep 3, 2026
dependabot#1517 and #1518 proposed this bump against codeql-pr.yml's inline init/analyze steps, but those steps moved to codeql-scan-dispatch.yml during the CodeQL dispatch+poll rebuild (#1772/#1774/#1776/#1778) after the PRs were opened -- both are now DIRTY (git can't find the lines they target). Applying the same verified v4.37.9 SHA (cdf488f595d80d6e07e03d4674febd5ab45fa938, confirmed against github/codeql-action's own tag ref) at all 12 live call sites instead: codeql-scan-dispatch.yml, scheduled-security-scan.yml, scorecard-analysis.yml, python-security.yml, sast-semgrep.yml, secret-scan.yml, security-scan.yml (x3). Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
codeql-pr.yml's CodeQL analysis jobs cannot run inside a required workflow — GitHub categorically disallowsgithub/codeql-action/init/analyzethere (root-caused and fixed by removal from ruleset18156473in docs(doctoring): record codeql-pr.yml required-workflow platform restriction #1767 / docs/doctoring/codeql-pr-required-workflow-always-fails.md).strix.ymlandopencode-review.yml— a required-workflow-safe entrypoint in the target repo dispatches the actualcodeql-actionwork viarepository_dispatchto a new native.github/workflows/codeql-scan-dispatch.yml, which reports back via commit status.analyze-merge(required nowhere per fix(ci): job-level runner-admission gate for required workflows #1766), security considerations (payload forgery/TOCTOU, cross-repo checkout trust boundary, status-publish credential scope, spoofable poll targets), alternatives rejected, and a 5-step implementation follow-up.codeql-pr.ymlrewrite) is tracked as separate follow-up work per the ADR's own "Follow-up" section.Test plan
scripts/ci/codeql_sarif_gate.py+ tests, newcodeql-scan-dispatch.yml,codeql-pr.ymlrewrite, a contract test asserting zerocodeql-actionreferences remain incodeql-pr.yml, then re-adding it to ruleset18156473and verifying a real PR passes.🤖 Generated with Claude Code