ci(codeql): let the scan be triggered on demand - #116
Merged
Merged
Conversation
The security tab reports this configuration as "Actions workflow not enabled" while the analyses it lists are real and current — both languages scanned the tip of main and returned no alerts. One of those two statements is stale and there is currently no way to find out which. Every existing trigger waits on an event: a push to main, a pull request, or Monday. None can be asked a question. workflow_dispatch adds the button, so the configuration can be confirmed directly instead of inferred from whether checks appear on the next PR. No paths-ignore on the manual trigger, unlike push and pull_request: asking for a run by hand is an explicit request for a full scan, and skipping it because the last commit touched a markdown file would defeat the point. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
bgard68
added a commit
that referenced
this pull request
Sep 11, 2026
Extends the CodeQL change in #116 to the three other workflows that can run standalone. Adds workflow_dispatch to ci.yml, web-ci.yml and secret-scan.yml. web-ci needed it most: its paths filter is ['web/**', its own file], which is correct but means a backend-only change never exercises it, and it was the one workflow still absent from the Actions registry because nothing had triggered it. The others re-registered on their own once #116's checks ran. dependency-review stays pull_request-only — the action diffs a base against a head, so a manual run has nothing to compare. keep-warm stays disabled_manually, which is a deployment decision rather than a registration fault. No paths filters on the manual triggers: pressing the button is an explicit request to run the whole thing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
workflow_dispatchto the CodeQL workflow. One line of behaviour change: a Run workflow button in the Actions tab. Samesecurity-extendedsuite, same two languages, same SARIF upload to Security → Code scanning.Why
The security tab currently reports this configuration as "Actions workflow not enabled", while the analyses it lists are real and current — both
csharpandjavascript-typescriptscanned8c94ecf(the tip ofmain) and returned 0 open alerts.Those two statements can't both be right, and there's no way to find out which is stale. Every existing trigger waits on an event — a push to
main, a pull request, or Monday 07:13 UTC — so the configuration can only be probed by opening a PR and seeing whether the Analyze checks show up. This makes it a button press.Worth noting alongside it: the Actions API registers only 6 of the 11 workflows committed on
origin/main, and reports zero runs for any of them, including ones observed running.codeql.yml,ci.yml,dependency-review.yml,secret-scan.ymlandweb-ci.ymlare the five missing. SHA pinning was ruled out as the cause —sha_pinning_requiredis on and all 11 workflows are fully pinned. This PR doesn't claim to fix that; it makes it diagnosable.Note on the trigger
No
paths-ignoreonworkflow_dispatch, unlikepushandpull_request. Asking for a run by hand is an explicit request for a full scan; skipping it because the last commit touched a markdown file would defeat the purpose.The
if: github.event.repository.visibility == 'public'guard is unchanged and still applies —github.event.repositoryis populated on dispatch events, and the repo is public.🤖 Generated with Claude Code