ci(security): restore interim PR-triggered CodeQL coverage - #1059
ci(security): restore interim PR-triggered CodeQL coverage#1059seonghobae wants to merge 1 commit into
Conversation
PR #513 (commit 479fc05) deleted the local codeql.yml on 2026-07-11, assuming ContextualWisdomLab/.github's central required-workflow ruleset (id 18156473) already ran CodeQL PR here. Verified false on 2026-09-02: ruleset 18156473 does not include codeql-pr.yml, leaving this repo with zero CodeQL PR coverage. Restores a minimal pull_request-triggered CodeQL workflow as a temporary safety net, matching the central codeql-pr.yml's CodeQL Action version (v4.37.8) and this repo's verified language matrix (python, javascript-typescript — confirmed via codeql-backfill.yml and repo language stats). Remove once an org admin confirms ruleset 18156473 covers codeql-pr.yml (tracked separately; not fixable from this repo). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 56 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| persist-credentials: false | ||
| ref: ${{ github.event.pull_request.head.sha }} |
There was a problem hiding this comment.
🟡 PR-head results attach to merge revision
After checkout selects the PR head, analyze defaults to the merge ref and SHA. Code scanning attributes head-only results to unscanned merged code.
Prompt for agents
The workflow checks out github.event.pull_request.head.sha, but github/codeql-action/analyze receives no ref or sha inputs. On a pull_request run, its defaults remain GITHUB_REF and GITHUB_SHA for refs/pull/<number>/merge and the synthetic merge commit. Align the analyzed checkout and upload identity: either analyze the default merge checkout, or explicitly upload the head analysis with the matching refs/pull/<number>/head ref and pull request head SHA. Verify fork pull-request handling when choosing the latter.
Was this helpful? React with 👍 or 👎 to provide feedback.
| - name: Checkout PR head | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| persist-credentials: false | ||
| ref: ${{ github.event.pull_request.head.sha }} |
There was a problem hiding this comment.
🔍 Merge-preview coverage remains absent
checkout scans only the PR head. Repository guidance requires security scans against the merge ref, leaving base-branch interactions outside this safety net.
Was this helpful? React with 👍 or 👎 to provide feedback.
seonghobae
added
area: ci-cd
ChatGPT Codex Connector
|
Closing as redundant: the actual root-cause fix has landed. Org ruleset The gap has since been fixed at the root: an org administrator granted
Closing this interim workflow in favor of the central one, per this repo's own "remove once ruleset confirmed fixed" note in the PR description. |
1 participant
Summary
This repo currently has zero CodeQL PR coverage.
.github/workflows/codeql.ymlwas deleted in PR #513 (commit
479fc0556e36bd1524f6011602477c3243860dbf, merged2026-07-11) on the assumption that
ContextualWisdomLab/.github's centralrequired-workflow ruleset (id
18156473) already rancodeql-pr.ymlhere. Thatassumption was verified false on 2026-09-02: ruleset
18156473does notactually include
codeql-pr.yml.Adds back a minimal
pull_request-triggered CodeQL workflow as a temporarysafety net until an org admin fixes the ruleset (tracked separately — not
fixable from this repo).
v4.37.8, matching the centralcodeql-pr.yml.python,javascript-typescript) verified against thisrepo, not guessed: matches the existing
.github/workflows/codeql-backfill.ymlmatrix and the repo's actual language breakdown (Python backend, TS/JS
frontend; no Java/Kotlin).
codeql-pr.yml(no merge-preview job,no custom SARIF gate) — this repo doesn't need that org-specific logic; a
standard
init/autobuild/analyzeon the PR head restores baselinecoverage.
actionlintpasses clean on the new file.Only
.github/workflows/codeql.ymlis touched.Test plan
actionlint .github/workflows/codeql.yml— passes18156473includescodeql-pr.yml, then this workflow is removed🤖 Generated with Claude Code