From fc738043174b1c708826cae840a3b7655fbe1515 Mon Sep 17 00:00:00 2001 From: Shugoki <35711149+ShugokiFable@users.noreply.github.com> Date: Fri, 4 Sep 2026 12:41:44 -0300 Subject: [PATCH] Drop advanced CodeQL; Default Setup owns scans. GitHub Default Setup is already configured. The advanced workflow was disabled_manually, Dependabot PR #11 could not run it, and bumping codeql-action failed the MANIFEST hash gate. Remove .github/workflows/codeql.yml, drop the codeql-action Dependabot group, and resync MANIFEST.json sha256+size for the gated paths changed in this commit. --- .github/dependabot.yml | 6 ------ .github/workflows/codeql.yml | 19 ------------------- DECISIONS.md | 7 ++++--- MANIFEST.json | 18 ++++++------------ SBOM.spdx.json | 21 +++------------------ tests/test_ci_validation.py | 12 ++++++++++-- 6 files changed, 23 insertions(+), 60 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3f18f66..c6d35c1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,13 +3,7 @@ updates: - package-ecosystem: github-actions directory: / schedule: {interval: weekly} - # codeql-action/init and codeql-action/analyze must run the SAME release. - # Ungrouped, Dependabot raises one PR per action, so each PR bumps half the - # pair and CodeQL fails with "Loaded a configuration file for version X, but - # running version Y". Grouping makes the pair move in a single commit. groups: - codeql-action: - patterns: ["github/codeql-action*"] actions: patterns: ["actions/*"] - package-ecosystem: gomod diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index da67b19..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: CodeQL -on: - push: {branches: [main]} - pull_request: - schedule: [{cron: "23 4 * * 1"}] -permissions: {contents: read, security-events: write} -jobs: - analyze: - runs-on: ubuntu-latest - strategy: {matrix: {language: [python, go]}} - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: {persist-credentials: false} - - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 - with: {languages: "${{ matrix.language }}"} - - if: matrix.language == 'go' - working-directory: writer/native-go - run: go build ./... - - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 diff --git a/DECISIONS.md b/DECISIONS.md index 1b2cf37..a49153b 100644 --- a/DECISIONS.md +++ b/DECISIONS.md @@ -48,9 +48,10 @@ manifest generated from a differently normalised tree is worse than no manifest, because it fails for the honest verifier and no one else. - Preserve 4.2.5 as the rollback release and publish 5.0.0 beside it. -- Group `codeql-action/init` and `codeql-action/analyze` in Dependabot. They must - run the same release, and ungrouped updates split the pair across pull - requests and break every scan. +- CodeQL is GitHub Default Setup only. Do not keep an advanced CodeQL workflow + or a Dependabot `codeql-action` group: Default Setup already scans, the + advanced workflow is `disabled_manually`, and those PRs fail the MANIFEST + hash gate. - Preserve every 4.x safety boundary unchanged: no GUI launching, no arbitrary shell commands, no writes to live Skyrim `Data`, external processes disabled by default, and third-party tools hash-pinned rather than bundled. diff --git a/MANIFEST.json b/MANIFEST.json index bdecc40..7a91ef5 100644 --- a/MANIFEST.json +++ b/MANIFEST.json @@ -15,8 +15,8 @@ { "executable": false, "path": ".github/dependabot.yml", - "sha256": "c098ca332e35821423ba97c746f8d903ea5e0afc19e7fef81c6e71ece7c9c042", - "size": 642 + "sha256": "33678f190f32b3eeaf981f26460afe07a2852db96356dd268b77ff4381f8f71e", + "size": 263 }, { "executable": false, @@ -42,12 +42,6 @@ "sha256": "c49e70c532755b823a4fc01b0b65d9d98598c4b710f5ac57883433c73f888aa7", "size": 8519 }, - { - "executable": false, - "path": ".github/workflows/codeql.yml", - "sha256": "9bb18ddea813430d8c0bc134f33ea12b9632eee23a761e0715b4a817069c171f", - "size": 722 - }, { "executable": false, "path": ".github/workflows/release.yml", @@ -117,8 +111,8 @@ { "executable": false, "path": "DECISIONS.md", - "sha256": "650f9e420377515cfd9b93e2a1ed35299fe3d41de9936cf52e105d787e04ff5a", - "size": 3792 + "sha256": "59b86953ef3dc8ad7203e7ba72d78acd093d2fbc616b56c0c7ad8cca1b44b4d7", + "size": 3846 }, { "executable": false, @@ -1149,8 +1143,8 @@ { "executable": false, "path": "tests/test_ci_validation.py", - "sha256": "2a52432ca8a4f4ae8435e790af72d710bb07e080928ffb9263e3f655a078509d", - "size": 4375 + "sha256": "82ec883308707d19074285573ec74bc175ab54294ed8c067a1394fb5843be1a1", + "size": 4768 }, { "executable": false, diff --git a/SBOM.spdx.json b/SBOM.spdx.json index c6851b7..4bf4e89 100644 --- a/SBOM.spdx.json +++ b/SBOM.spdx.json @@ -44,7 +44,7 @@ "checksums": [ { "algorithm": "SHA256", - "checksumValue": "c098ca332e35821423ba97c746f8d903ea5e0afc19e7fef81c6e71ece7c9c042" + "checksumValue": "33678f190f32b3eeaf981f26460afe07a2852db96356dd268b77ff4381f8f71e" } ], "copyrightText": "NOASSERTION", @@ -114,21 +114,6 @@ "NOASSERTION" ] }, - { - "SPDXID": "SPDXRef-File-.github-workflows-codeql.yml", - "checksums": [ - { - "algorithm": "SHA256", - "checksumValue": "9bb18ddea813430d8c0bc134f33ea12b9632eee23a761e0715b4a817069c171f" - } - ], - "copyrightText": "NOASSERTION", - "fileName": "./.github/workflows/codeql.yml", - "licenseConcluded": "NOASSERTION", - "licenseInfoInFiles": [ - "NOASSERTION" - ] - }, { "SPDXID": "SPDXRef-File-.github-workflows-release.yml", "checksums": [ @@ -299,7 +284,7 @@ "checksums": [ { "algorithm": "SHA256", - "checksumValue": "650f9e420377515cfd9b93e2a1ed35299fe3d41de9936cf52e105d787e04ff5a" + "checksumValue": "59b86953ef3dc8ad7203e7ba72d78acd093d2fbc616b56c0c7ad8cca1b44b4d7" } ], "copyrightText": "NOASSERTION", @@ -2879,7 +2864,7 @@ "checksums": [ { "algorithm": "SHA256", - "checksumValue": "2a52432ca8a4f4ae8435e790af72d710bb07e080928ffb9263e3f655a078509d" + "checksumValue": "82ec883308707d19074285573ec74bc175ab54294ed8c067a1394fb5843be1a1" } ], "copyrightText": "NOASSERTION", diff --git a/tests/test_ci_validation.py b/tests/test_ci_validation.py index 8359d26..3fb4f1a 100644 --- a/tests/test_ci_validation.py +++ b/tests/test_ci_validation.py @@ -81,8 +81,16 @@ def test_dependabot_groups_the_codeql_pair(self): config = self.WORKFLOWS.parent / "dependabot.yml" if not config.exists(): self.skipTest("no dependabot configuration present") - self.assertIn("github/codeql-action", config.read_text(encoding="utf-8"), - "dependabot must group codeql-action so the pair cannot be split across pull requests") + workflows_text = "\n".join(w.read_text(encoding="utf-8") for w in self.WORKFLOWS.glob("*.yml")) + if "github/codeql-action" in workflows_text: + self.assertIn("github/codeql-action", config.read_text(encoding="utf-8"), + "dependabot must group codeql-action so the pair cannot be split across pull requests") + return + self.assertNotIn( + "github/codeql-action", + config.read_text(encoding="utf-8"), + "GitHub Default Setup owns CodeQL; dependabot must not track codeql-action", + ) def test_release_publish_is_idempotent(self): # Forge stopped publishing releases of its own when it moved into the