build(deps): align CodeQL 4.37.6 on accepted security base - #107
build(deps): align CodeQL 4.37.6 on accepted security base#107seonghobae wants to merge 1 commit into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughCodeQL ChangesCodeQL 워크플로 업데이트
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Review exact contributor head |
|
|
|
@opencode-agent @cwl-noema-review Review exact unchanged contributor head |
|
@coderabbitai full review Please review exact current contributor head |
|
|
|
@coderabbitai full review Review exact contributor head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="3703d0da9823b8258a0be94f1801aa5d61bfad9f"
head="28088b9fc86d975b43637b7758d25e20d61c5786"
echo "== Exact commit availability and relationship =="
git cat-file -e "${base}^{commit}"
git cat-file -e "${head}^{commit}"
git merge-base --is-ancestor "$base" "$head"
printf 'base: '; git rev-parse "$base"
printf 'head: '; git rev-parse "$head"
printf 'merge-base: '; git merge-base "$base" "$head"
echo "== Changed files and diff =="
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
git diff --no-ext-diff --unified=80 "$base" "$head" -- .github/workflows/security.yml
echo "== Workflow outline and relevant content at head =="
ast-grep outline .github/workflows/security.yml --items all || true
nl -ba .github/workflows/security.yml | sed -n '1,320p'
echo "== CodeQL pin occurrences at base and head =="
for ref in "$base" "$head"; do
echo "-- $ref --"
git show "${ref}:.github/workflows/security.yml" |
rg -n -C 3 'github/codeql-action/(init|analyze)@|permissions:|security-events:|actions: read|contents: read|category:|languages:|build-mode:'
done
echo "== PR metadata and upstream action commit metadata =="
gh pr view 107 --repo ContextualWisdomLab/contextual-orchestrator \
--json number,state,isDraft,baseRefOid,headRefOid,changedFiles,files,url
gh api repos/github/codeql-action/commits/5595ccaf912efad79be6eef63a5619ff05969be3 \
--jq '{sha:.sha,message:.commit.message,verification:.commit.verification,html_url:.html_url}'
gh api repos/github/codeql-action/git/ref/tags/v4.37.6 \
--jq '{ref:.ref,object_type:.object.type,object_sha:.object.sha}'Length of output: 5736 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="3703d0da9823b8258a0be94f1801aa5d61bfad9f"
head="28088b9fc86d975b43637b7758d25e20d61c5786"
pin="5595ccaf912efad79be6eef63a5619ff05969be3"
echo "== Full workflow at the exact head =="
git show "${head}:.github/workflows/security.yml" | sed -n '1,220p'
echo "== Semantic diff excluding CodeQL action references =="
git diff --no-ext-diff --unified=8 "$base" "$head" -- .github/workflows/security.yml |
grep -vE '^[+-].*github/codeql-action/(init|analyze)@|^[-+]{3}|^@@' || true
echo "== Action pins in base and head =="
for ref in "$base" "$head"; do
printf '%s: ' "$ref"
git show "${ref}:.github/workflows/security.yml" |
grep -E '^[[:space:]]*uses: github/codeql-action/(init|analyze)@' || true
done
echo "== PR `#107` exact metadata =="
gh pr view 107 --repo ContextualWisdomLab/contextual-orchestrator \
--json number,state,isDraft,baseRefName,baseRefOid,headRefName,headRefOid,changedFiles,url
echo "== CodeQL v4.37.6 tag and requested commit =="
gh api repos/github/codeql-action/git/ref/tags/v4.37.6
gh api repos/github/codeql-action/commits/"$pin" \
--jq '{sha:.sha,html_url:.html_url,message:.commit.message,verification:.commit.verification}'
echo "== Resolve annotated tag target when applicable =="
tag_object="$(gh api repos/github/codeql-action/git/ref/tags/v4.37.6 --jq '.object.type + " " + .object.sha')"
printf '%s\n' "$tag_object"
if [ "${tag_object%% *}" = "tag" ]; then
gh api "repos/github/codeql-action/git/tags/${tag_object#* }" \
--jq '{tag:.tag,object_type:.object.type,object_sha:.object.sha,verification:.verification}'
fiLength of output: 8695
I found no current-head actionable findings. Verified items:
This review does not qualify as independent human approval. PR ✅ Action performedFull review finished. |
1 participant
Purpose
Rebuild the CodeQL 4.37.6 dependency update on the exact current security base instead of carrying the historical protected-main Semgrep findings that block PR #106.
Exact identity
fix/atheris-interpreter-lock(PR fix(security): pin provider egress and repair the Atheris lock #96)3703d0da9823b8258a0be94f1801aa5d61bfad9f28088b9fc86d975b43637b7758d25e20d61c5786.github/workflows/security.ymlonlygithub/codeql-action/initandgithub/codeql-action/analyzeatomically from v4.37.0 to immutable v4.37.6 commit5595ccaf912efad79be6eef63a5619ff05969be3RCA and replacement rationale
PR #106 targets protected
main@6841b71935e0b7cb98fb52bcb4709cc5100c8d87. Its current SAST run checks out synthetic mergeaf0bfebc046b9b6a4832562c929224ad2c429ebaand fails on the five inherited protected-main findings incost_ledger.pyandorchestrator.py; its one-file CodeQL action diff does not touch those findings. PR #96 repairs that shared security boundary. Suppressing findings or duplicating the security repair in a dependency-only PR would be the wrong root-cause remedy.This replacement therefore applies the same atomic CodeQL update directly over the accepted exact #96 head. It must remain Draft while #96 is Draft or unintegrated. If #96 moves, this head/base evidence becomes historical and must be reconciled before acceptance.
Current exact-head evidence
All repository-local workflows explicitly fetched and checked out contributor head
28088b9fc86d975b43637b7758d25e20d61c5786with checkout credentials disabled:31353149983, job93347600723: success with 566 passed, 100% production statement and branch coverage (3,667 statements / 934 branches, zero misses/partials), and 100% public-docstring coverage.31353149993: success. Python supply-chain job93347600805found no known vulnerabilities and published CycloneDX SBOM artifact9049659096; CodeQL job93347600840analyzed 85/85 Python files and 3/3 workflow files using the updated immutable CodeQL 4.37.6 pin.31353149986: success. Hypothesis job93347601110completed 8 property tests; Atheris job93347601160completed all four bounded targets without a crash artifact.This evidence proves only repository-local exact-head Tests, Security, Fuzz, coverage, docstrings, dependency audit, SBOM generation, and CodeQL execution. PR #96 remains Draft and unintegrated, so this PR remains Draft. No result here substitutes for protected-base integration, fresh required automated review, or qualifying independent approval.
Acceptance
Require fresh exact-head repository checks and current review evidence for this reconstructed head. Do not promote predecessor, stale-base, synthetic-merge-only, status-only, author-only, queued, skipped-required, absent, failed, or rate-limited evidence to success. Merge only after #96 reaches protected integration, this bounded update is reconciled onto that exact result if needed, all required checks/security gates pass, zero valid unresolved findings remain, and a qualifying independent non-author approval applies to the unchanged head.
Supersedes #106 after replacement identity and checks are confirmed.
Summary by CodeRabbit
Current-head automated review refresh (2026-08-12)
CodeRabbit full-review comment
5263499272inspected exact contributor head28088b9fc86d975b43637b7758d25e20d61c5786against exact stacked base3703d0da9823b8258a0be94f1801aa5d61bfad9fand found no current-head actionable finding. It independently verified the one-file range, atomicinit/analyzeupdate, immutable5595ccaf912efad79be6eef63a5619ff05969be3pin, annotatedv4.37.6tag resolution, valid commit signature, and unchanged permissions/supply-chain behavior. This is automated comment evidence, not a formal review or qualifying independent human approval. Formal reviews and unresolved threads remain zero; keep this PR Draft behind unintegrated #96.