chore(ci): remove nonfunctional CodeQL analyze job - #122
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Warning Review limit reached
Next review available in: 33 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Comment |
…rozen (#126) The gate reads as frozen (~25h with 16+ CLEAN PRs) but is actually a single-runner throughput queue plus the fleet auto-ship review ladder. Snapshot: 14 CLEAN / 27 BLOCKED / 9 DIRTY PRs, 27 queued CI runs, one busy runner, last merge #122 at 10:59 UTC. The runner CI fix landed 2026-08-11; merges resumed and auto-ship is actively draining the queue. Captures the measured ~2.5-min CI duration, the ladder states (WAITING on two-flagship panels, SKIPPED awaiting flagship review, HELD for Nish authority), and the local-only retention-automation path failure (machine state, not repo content). Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
…epo-checks The old CodeQL analyze job was removed in #122 because this private personal-account repo has no GHAS entitlement: the SARIF upload rejects with "Code scanning is not enabled for this repository", and before that the ENABLE_PRIVATE_CODEQL gate made it silently SKIP every run (no security signal at all). Add npm audit --audit-level=high to the required repo-checks job as a free, always-running dependency security scan, and document the CodeQL removal/re-enable path in .github/workflows/README.md so nobody re-introduces a green-SKIP workflow as the security signal.
…epo-checks (#129) The old CodeQL analyze job was removed in #122 because this private personal-account repo has no GHAS entitlement: the SARIF upload rejects with "Code scanning is not enabled for this repository", and before that the ENABLE_PRIVATE_CODEQL gate made it silently SKIP every run (no security signal at all). Add npm audit --audit-level=high to the required repo-checks job as a free, always-running dependency security scan, and document the CodeQL removal/re-enable path in .github/workflows/README.md so nobody re-introduces a green-SKIP workflow as the security signal.
…iberate removal (PR #122) with npm audit substitute (PR #129) (#183) * docs(lane1): reverify codeql private-repo gate item — resolved by deliberate removal (PR #122) with npm audit substitute (PR #129) Co-authored-by: CommandCodeBot <noreply@commandcode.ai> * docs(lane1): add PR link to codeql reverify report Co-authored-by: CommandCodeBot <noreply@commandcode.ai> --------- Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
…+ private-repo gate) main removed .github/workflows/codeql.yml (PR #122, no GHAS entitlement). This PR re-adds it with the actions:read permission fix and the restored private-repo gate (ENABLE_PRIVATE_CODEQL opt-in), so the job stays clean (gated) until code scanning/GHAS is provisioned. Resolve modify/delete in favor of the PR version.
1 participant
Problem
PR check lists advertise
analyze javascript-typescript: SKIPPEDas greenwhile no CodeQL analysis ever runs. The job is gated on
github.event.repository.private == false || vars.ENABLE_PRIVATE_CODEQL == '1';this repository is private and the variable is unset (
actions/variables→[]), so the job skips on every run. A permanently-skippedanalyzein agreen check list advertises security analysis that never happens.
Why remove instead of enable
CodeQL on a private repository requires a GitHub Advanced Security
entitlement. This repo has none:
security_and_analysisisnullonGET /repos/nish3451/tinystudio-in, which is the API's signal that theaccount's plan does not include GHAS. Enabling it would require a paid plan
upgrade — a money decision that is out of scope here, so the misleading job is
removed instead.
analyze javascript-typescriptis not a required context(required:
repo-checksonly), so removing it does not touch the merge gate.Change
Delete
.github/workflows/codeql.yml(theanalyzejob is its only job). Noother workflow references it, and no action pins are touched in other files.
Never merge — review and merge is owned by the fleet process.