fix(security): keep every CodeQL Action phase on one revision by seonghobae · Pull Request #780 · ContextualWisdomLab/bandscope

seonghobae · 2026-08-07T06:56:00Z

Outcome

Keep BandScope's checked-in CodeQL lifecycle under one canonical supply-chain owner instead of merging init, autobuild, analyze, and upload-sarif Dependabot fragments independently. The branch also preserves the valid repository-control deltas absorbed from competing PR #1026 while leaving organization-wide Scorecard/queue policy with its canonical owner.

Fresh exact identity

Protected base: develop@889d782e88b4df28dcbb4ae3cfd6d99ef85d9844.
Branch: fix/codeql-action-consistency-v4-37-6.
Exact current head: a08e154e5a4503b01aa60a75ffd423ec8b5fc41b.
Non-force restack: current branch head e9f222e1ca6e9f818ed1da4c47a522c8260bd5a9 was merged with protected develop@889d782e...; the only intervening protected delta was apps/desktop/src-tauri/Cargo.lock, adopted byte-for-byte from protected develop rather than hand-edited or regenerated.
Direct comparison to protected develop: ahead_by=26, behind_by=0, merge base exactly 889d782e88b4df28dcbb4ae3cfd6d99ef85d9844.
Semantic PR delta remains bounded to nine files: .github/dependabot.yml, CodeQL/Scorecard/Trivy workflows, one doctoring note, and four executable CodeQL/Scorecard/Dependabot regression contracts. apps/desktop/src-tauri/Cargo.lock is not a PR delta after restack.
PR remains Draft. Current-head checks are newly materializing and no qualifying independent non-author approval exists. There are zero inline review threads and zero submitted reviews.

Atomic v4.37.9 lifecycle

Every checked-in github/codeql-action/init, autobuild, analyze, and upload-sarif reference in this owner lane uses immutable commit cdf488f595d80d6e07e03d4674febd5ab45fa938 with v4.37.9 annotation.

Upstream resolution on 2026-09-02 found refs/tags/v4.37.9 -> annotated tag object a35ac6e6798d72df5475948b28efb89edc2e19ca -> commit cdf488f595d80d6e07e03d4674febd5ab45fa938. The tag is unsigned, so this PR makes no signed-tag claim. v4.37.9 advances the default CodeQL bundle to 2.26.4.

services/analysis-engine/tests/test_codeql_action_revision_contract.py scans every workflow for init|autobuild|analyze|upload-sarif, catches mutable/malformed refs, and requires the reviewed SHA plus matching release annotation. codeql.yml additionally keeps init/autobuild/analyze atomic.

Preserved repository-control behavior

The competing lifecycle writer #1026 contained non-version deltas that were not safe to discard. Their valid BandScope-local behavior remains represented here:

.github/dependabot.yml routes GitHub Actions updates to the repository's valid CI/CD taxonomy; test_dependabot_label_contract.py prevents regression.
Pull-request CodeQL/Scorecard trust-boundary behavior is covered by executable contracts. Repository-owned extraction/normalization authority must come from a trusted protected-base context rather than untrusted PR-head execution, and the lane must not introduce pull_request_target as a shortcut.
The latest owner refinement defers organization-wide Scorecard publication/policy to the central owner instead of duplicating that authority inside BandScope.

#1026's narrower CodeQL version/uploader tests are semantically covered by the broader all-workflow revision contract here. Predecessor checks, reviews, approvals, and statuses do not transfer.

TDD and repair lineage

RED e1ed1ced7ac77b36bab9abb744da39a232ecb154: executable contracts required the coordinated v4.37.9 lifecycle and repository trust-boundary behavior before production workflow/config alignment.
Initial GREEN 823a66200f7a9c846147d3632cc167c1c8f08c65: aligned the owning workflows/config/doctoring.
Current semantic owner before restack e9f222e1ca6e9f818ed1da4c47a522c8260bd5a9: incorporated later repository-control refinements, including deferral of central Scorecard ownership.
Restack a08e154e5a4503b01aa60a75ffd423ec8b5fc41b: merges protected develop@889d782e... without force-push and changes only the protected Tauri lockfile relative to e9f222e...; against protected develop the nine-file CodeQL/security semantic delta is unchanged.

Exact-head verification

All predecessor-head hosted evidence is invalid for a08e154e5a4503b01aa60a75ffd423ec8b5fc41b. Fresh exact-head workflows must complete on this head before readiness or merge. Queued/pending/cancelled/skipped-required evidence is non-passing.

Split dependency ownership

Fresh v4.37.9 component PRs such as #1135 (autobuild), #1139 (upload-sarif), and #1141 (analyze) are dependency fragments, not independent lifecycle authority. Do not merge them separately or transfer their checks/reviews. Do not close those split PRs merely because this branch contains their version delta: close them only after this coordinated lifecycle is accepted under the protected merge gate or a verified successor completely inherits their valid delta/evidence contract.

#783's JavaScript dependency-security baseline is already in protected develop ancestry, so stale text treating #783 as pending is not a blocker here.

Security Notes

The change executes one reviewed immutable CodeQL Action revision across all phases and keeps PR script authority on trusted repository state. It adds no application filesystem, URL, model, database, IPC, credential, or runtime-network authority. Pull-request code-scanning upload capability still depends on GitHub token/repository policy; this PR does not fabricate success for forks or actors without required permission.

Merge gate

Keep Draft and unmerged until this unchanged exact head has every applicable repository and central CI/security/SAST/SBOM/supply-chain/coverage/release check terminal-success, zero valid unresolved findings, a qualifying independent non-author last-push approval, and ordinary protected-branch acceptance. Never force-push, self-approve, weaken a gate, or merge one CodeQL phase independently.

Relates to #966.

coderabbitai · 2026-08-07T06:56:07Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-07T10:45:11Z

/oc Refetch the live pull request and abort without writing unless its exact head is 7c9343aede26a44239b12c805fdd0ab0b1398dba on branch fix/codeql-action-consistency-v4-37-6. Exact-head CI run 31170110007, job 92839810936, is the authoritative RED evidence: the Rust/Tauri gate passed; quickcheck reached Ruff after all documentation, security-pattern, supply-chain, bootstrap, frontend workspace lint, and docstring gates passed; the only quality failure is I001 for the import block in services/analysis-engine/tests/test_codeql_action_revision_contract.py. Apply the formatter-derived minimum repair only: from services/analysis-engine, run the repository-pinned uv run ruff check tests/test_codeql_action_revision_contract.py --select I --fix, inspect the diff, and commit only Ruff's canonical import-block ordering. Do not hand-guess another style, change the test behavior, CodeQL SHA/version contract, workflows, dependencies, lockfiles, doctoring, release metadata, or unrelated files. Run the focused Ruff check and the two CodeQL contract tests first, then the complete exact-head quickcheck, CI, Rust/Tauri, package/release, SBOM, Security Scan, SAST, and git diff --check. The known two high-severity JavaScript findings belong to atomic baseline PR #783 and must not be papered over here. Do not create another branch, PR, one-shot/self-modifying workflow, patch artifact, or encoded patch. Keep Draft until the new exact head is fully green, current-head actionable threads are zero, #783 has established the protected dependency baseline or this branch is rebased onto it, and a qualifying independent non-author approval exists.

Rebuild the PR from protected develop with only the atomic CodeQL lifecycle update, its test-first contract, doctoring record, and changelog entry. Remove unrelated PDF.js and npm lockfile drift from this branch.

seonghobae · 2026-08-14T09:39:12Z

Exact-head triage at 0a6ae2b4d749d473f3b0a451bed1a6a58c876080: CI/build/release/SBOM/Bandit/secret/Semgrep are green, but security-audit and Security Scan fail because this branch still inherits the protected-base npm findings for nanoid <3.3.18, pdfjs-dist <6.2.108, and undici <=7.28.0. Those are being remediated atomically by #783; duplicating that package/lockfile work here would create conflicting supply-chain ownership. Keep #780 blocked on #783 rather than copying its fix. After #783 lands, rebase/refresh #780 on the new develop, then require exact-new-head security and review evidence before Ready/merge.

seonghobae · 2026-08-14T10:09:25Z

@opencode-agent Review the exact current head 0a6ae2b4d749d473f3b0a451bed1a6a58c876080 against protected develop and submit a formal current-head decision. I re-verified upstream github/codeql-action annotated tag v4.37.6: it dereferences to commit 5595ccaf912efad79be6eef63a5619ff05969be3, matching every CodeQL phase and SARIF uploader in this PR. Do not reuse predecessor-head review evidence.

Update every CodeQL lifecycle phase and SARIF uploader to the verified upstream v4.37.7 commit, refresh the regression contract, changelog, and doctoring, and record the v2.26.3 bundle update. Preserve immutable SHA pinning and the existing atomic-version policy.

opencode-agent · 2026-08-19T04:59:40Z

Queued @opencode-agent for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

opencode-agent · 2026-08-20T03:30:13Z