From a409bbfba150ddbba2c41e87a3896d1393ae013b Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Fri, 11 Sep 2026 07:16:36 -0500 Subject: [PATCH] ci(codeql): let the scan be triggered on demand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The security tab reports this configuration as "Actions workflow not enabled" while the analyses it lists are real and current — both languages scanned the tip of main and returned no alerts. One of those two statements is stale and there is currently no way to find out which. Every existing trigger waits on an event: a push to main, a pull request, or Monday. None can be asked a question. workflow_dispatch adds the button, so the configuration can be confirmed directly instead of inferred from whether checks appear on the next PR. No paths-ignore on the manual trigger, unlike push and pull_request: asking for a run by hand is an explicit request for a full scan, and skipping it because the last commit touched a markdown file would defeat the point. Co-Authored-By: Claude Opus 5 --- .github/workflows/codeql.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index dd15b95..fd6ca93 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,6 +20,12 @@ on: schedule: - cron: "13 7 * * 1" + # Run on demand. The other three triggers all depend on something happening — a push, a PR, or + # Monday — so when the security tab reports this configuration as not enabled there is no way to + # ask it for an answer and find out whether that is stale or real. Carries no paths-ignore on + # purpose: a manual run is an explicit request for a full scan. + workflow_dispatch: + permissions: contents: read