From 0e9a204cde6d18fef8130ba6069917faea24553e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 05:17:36 +0900 Subject: [PATCH] fix(codeql): name a status credential that is not configured The four-rung credential ladder in "Publish CodeQL dispatch status" returns before printing when a token is empty, so an unconfigured rung and one that was never reached look identical in a run log: the label simply does not appear. That hid half the ladder in production. In run 34017996201 -- one of the runs created during the ~69-second window when the dispatch allowlist was open, so it is one of the few that reached this step at all -- the log carries: ##[notice] ... using target-app-token did not succeed: HTTP 403 ##[notice] ... using github-token did not succeed: HTTP 403 ##[error] Could not publish ... after all configured credentials failed Nothing for `pr-review-merge-token` or `opencode-approve-token`. The only way to tell those two were empty rather than skipped was to count label occurrences in the raw log: two for each configured rung (source echo plus runtime notice) and one for each empty rung. That is not a diagnosis anyone should have to reconstruct while an outage is live. This changes no credential, permission or ordering -- it adds one line so an absent rung says it is absent. Worth recording alongside it, because the fix does not address it: the two rungs that ARE configured both fail with `Resource not accessible by integration (HTTP 403)` on a cross-repository status write. So the dispatch allowlist (.github#1929) is necessary but not sufficient -- opening it lets runs reach this step and stop here instead. Naming the empty rungs is what makes that second break legible the next time a run gets through. The test executes the published block under bash with a stub `gh` that refuses every request, two rungs configured and two empty, and requires the four labels to be distinguishable by outcome. Gates: 2976 passed (2975 + 1, as predicted), coverage 100%, interrogate 100%. Negative control: deleting the notice line fails exactly this test. Co-Authored-By: Claude Opus 5 --- .github/workflows/codeql-scan-dispatch.yml | 10 +++ ..._codeql_scan_dispatch_workflow_contract.py | 64 +++++++++++++++++++ 2 files changed, 74 insertions(+) diff --git a/.github/workflows/codeql-scan-dispatch.yml b/.github/workflows/codeql-scan-dispatch.yml index 1c9dda3e45..f5d7659420 100644 --- a/.github/workflows/codeql-scan-dispatch.yml +++ b/.github/workflows/codeql-scan-dispatch.yml @@ -437,6 +437,16 @@ jobs: token_label="$1" token="$2" if [ -z "$token" ]; then + # Name the absent rung. Without this line an unconfigured + # credential and one that was never reached are the same thing in + # the log: `post_status` returned before printing, so the ladder + # simply skipped a label. On 2026-09-06 that hid the state of two + # of the four rungs -- run 34017996201 published notices for + # target-app-token and github-token (both HTTP 403) and nothing at + # all for pr-review-merge-token or opencode-approve-token, so the + # only way to tell those two were empty was that their labels + # appeared once (the source echo) instead of twice. + echo "::notice::CodeQL dispatch status publish skipped ${token_label}: credential is not configured." return 1 fi status_response="$(mktemp)" diff --git a/tests/test_codeql_scan_dispatch_workflow_contract.py b/tests/test_codeql_scan_dispatch_workflow_contract.py index 71fa43541f..cc8202f6b0 100644 --- a/tests/test_codeql_scan_dispatch_workflow_contract.py +++ b/tests/test_codeql_scan_dispatch_workflow_contract.py @@ -522,3 +522,67 @@ def test_codeql_scan_dispatch_serialises_the_matrix_payload() -> None: assert ( "SUPPLIED_MATRIX: ${{ github.event.client_payload.matrix" not in workflow ), "SUPPLIED_MATRIX must not assign the raw client_payload array to env:" + + +def test_status_publish_names_an_absent_credential_separately_from_a_failed_one(tmp_path): + """An unconfigured rung must say so, not vanish from the ladder's log. + + ``post_status`` returns before printing when its token is empty, so an + absent credential and one that was never reached produced identical output: + nothing. On 2026-09-06 run ``34017996201`` that hid half the ladder -- + notices appeared for ``target-app-token`` and ``github-token`` (both + ``HTTP 403``) and for neither middle rung, and the only way to tell those two + were empty rather than skipped was that each label occurred once in the log + (the step's own source echo) instead of twice. + + This runs the published block under bash with a stub ``gh`` that fails every + request, two rungs configured and two empty, and requires the four labels to + be distinguishable by outcome. + """ + bash = shutil.which("bash") + if bash is None: + return + workflow_text = WORKFLOW_PATH.read_text(encoding="utf-8") + script = _extract_run_block(workflow_text, "Publish CodeQL dispatch status") + + stub_dir = tmp_path / "bin" + stub_dir.mkdir() + gh_stub = stub_dir / "gh" + gh_stub.write_text( + "#!/bin/sh\n" + "echo 'gh: Resource not accessible by integration (HTTP 403)' >&2\n" + "exit 1\n", + encoding="utf-8", + ) + gh_stub.chmod(0o755) + + env = dict(os.environ) + env["PATH"] = f"{stub_dir}{os.pathsep}{env['PATH']}" + env.update( + { + "GATE_OUTCOME": "success", + "TARGET_APP_STATUS_TOKEN": "present-app-token", + "PR_REVIEW_MERGE_STATUS_TOKEN": "", + "OPENCODE_APPROVE_STATUS_TOKEN": "", + "GITHUB_STATUS_READ_TOKEN": "present-github-token", + "TARGET_REPOSITORY": "ContextualWisdomLab/example", + "HEAD_SHA": "0" * 40, + "LANGUAGE": "python", + "GITHUB_SERVER_URL": "https://github.com", + "GITHUB_REPOSITORY": "ContextualWisdomLab/.github", + "GITHUB_RUN_ID": "1", + } + ) + result = subprocess.run( + [bash], input=script, env=env, capture_output=True, text=True, check=False + ) + output = result.stdout + result.stderr + + assert result.returncode == 1 + # The two configured rungs report the upstream refusal. + for label in ("target-app-token", "github-token"): + assert f"publish using {label} did not succeed" in output + # The two empty rungs say they were never configured, rather than going silent. + for label in ("pr-review-merge-token", "opencode-approve-token"): + assert f"publish skipped {label}: credential is not configured" in output + assert "after all configured credentials failed" in output