ci(codeql): add actions:read so the analyze step can finish; keep private-repo gate until code scanning is available - #89
Conversation
…h uploading The analyze job now runs on every trigger (PR, push to main/codex/**, weekly schedule, workflow_dispatch) but dies in the final step with: ##[error]Resource not accessible by integration https://docs.github.com/rest/actions/workflow-runs#get-a-workflow-run The codeql-action's final status/upload call reads the workflow run (REST get-a-workflow-run), which needs the actions scope. The explicit permissions block zeroes every scope not listed, and 'actions' was not listed, so GITHUB_TOKEN had no actions access. Add actions: read. Also carries the private-repo gate drop (same change as PR #82) so the fix is verifiable here: on main the gate still skips the job.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
📝 WalkthroughWalkthroughThe CodeQL workflow now grants ChangesCodeQL workflow
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Run 31508386840 proved the actions:read fix: the analyze step now gets
past the telemetry call and reaches the SARIF upload, which rejects with:
##[error]Code scanning is not enabled for this repository.
This repo is a private personal-account repo without GitHub Advanced
Security ('Advanced security has not been purchased' from the settings
API; code scanning is an Enterprise/org-with-GHAS feature). The final
step can never succeed while the repo stays private, so running ungated
fails red on every trigger and wastes the shared VPS runner. Restore the
private-repo gate with the ENABLE_PRIVATE_CODEQL opt-in as the path to
enable the (now upload-ready) run when GHAS or public visibility lands.
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
nish3451
changed the title
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
…+ private-repo gate) main removed .github/workflows/codeql.yml (PR #122, no GHAS entitlement). This PR re-adds it with the actions:read permission fix and the restored private-repo gate (ENABLE_PRIVATE_CODEQL opt-in), so the job stays clean (gated) until code scanning/GHAS is provisioned. Resolve modify/delete in favor of the PR version.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
1 participant
The failure this fixes
PR #82 dropped the private-repo gate, so the CodeQL analyze job started running on every trigger — and died in its final step:
The codeql-action's final status/upload call reads the workflow run (REST
get-a-workflow-run), which needs theactionsscope. The explicitpermissions:block (contents: read+security-events: write) zeroed every other scope for GITHUB_TOKEN. Analysis itself always succeeded (141/142 JS files scanned); only the telemetry call failed.Fix 1 —
actions: read(kept, verified)Add
actions: readto the workflow-level permissions block. Proven on this PR: run 31508386840 got past theResource not accessibleerror and reached the SARIF upload.Fix 2 — the wall that cannot be fixed in a workflow file
That run then revealed the next blocker at the upload step:
Confirmed by API:
PATCH /repos/.../security_and_analysis[advanced_security]=enabled→Advanced security has not been purchased.(422). This repo is a private personal-account repo; GitHub code scanning for private repos requires an org with GitHub Advanced Security (Enterprise). It cannot be enabled here, so the final step can never succeed while the repo stays private.Resolution
actions: readpermission fix — correct and ready for the day code scanning exists.ENABLE_PRIVATE_CODEQL=1opt-in as the enable path). Ungated, every PR/schedule run fails red and burns ~6 min of the fleet's only shared verification runner for a check that can never upload; gated, the workflow stays clean.Verification
actions: read / contents: read / security-events: write.Resource not accessible, SARIF exported, upload rejected only on code-scanning-not-enabled).repo-checksis required).Summary by CodeRabbit