From 6a8d9f0fefc73edeec245ad2becbb4d3a401f462 Mon Sep 17 00:00:00 2001 From: Mark Beacom Date: Sat, 8 Aug 2026 17:53:58 -0400 Subject: [PATCH] ci(codeql): replace default setup with an advanced workflow so required checks report The `main` ruleset requires the status checks `Analyze (actions)` and `Analyze (javascript-typescript)`, but those check runs were produced by CodeQL *default* setup, which "does not run on pull requests from forks". On any fork PR the checks were therefore never created at all, and a required check that is never reported sits at "Expected - Waiting for status to be reported" indefinitely with no way to clear it. Observed on #97 (fork) and #99 (Dependabot): neither head SHA has a CodeQL workflow run of any kind. The "N configurations present on refs/heads/main were not found" warning on the results check is the same fault seen from the other side: `main` has a baseline analysis for `/language:actions` and `/language:javascript-typescript`, the PR has neither, so code scanning cannot diff them and cannot attribute alerts to the pull request. Advanced setup fixes both because it is an ordinary `pull_request` workflow. It runs for forks and for Dependabot, and code scanning permits SARIF upload from `pull_request`-triggered runs even under a read-only token. The job name renders exactly `Analyze (actions)` and `Analyze (javascript-typescript)`, so the existing ruleset contexts keep resolving and no ruleset edit is needed; `category` stays `/language:` so analyses keep the category keys the default-setup baseline used and PR-vs-base comparison survives the switch. Both languages are interpreted, so `build-mode: none`. Actions are SHA-pinned with a trailing version comment to match the other workflows and to stay in Dependabot's `github-actions` group. Default setup must stay disabled: re-enabling it disables this workflow and blocks its uploads. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/codeql.yml | 80 ++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..199cf0eb --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,80 @@ +# CodeQL advanced setup. +# +# This replaces GitHub's CodeQL *default* setup, which cannot satisfy this +# repository's ruleset. The `main` ruleset requires the status checks +# `Analyze (actions)` and `Analyze (javascript-typescript)`, but default setup +# does not run "on a pull request based against the repository's default branch +# ... excluding pull requests from forks", so fork PRs (and, observed here, +# Dependabot PRs) never produce those check runs. A required check that is never +# reported stays "Expected - Waiting for status to be reported" forever, which +# blocks the PR with no way to clear it. The same gap is what makes the results +# check report "N configurations present on refs/heads/main were not found": +# `main` has a baseline for both languages and the PR has none. +# +# Advanced setup fixes both because the workflow is an ordinary `pull_request` +# workflow: it runs for forks and for Dependabot, and code scanning permits +# SARIF upload from `pull_request`-triggered runs even under a read-only token. +# +# Two things here are load-bearing and easy to break: +# +# - The job name must render exactly `Analyze (actions)` and +# `Analyze (javascript-typescript)`. Those strings are the required status +# check contexts in the `main` ruleset. Renaming the job, or renaming a +# matrix language, silently reintroduces the permanently-pending check. +# - `category` must stay `/language:` so analyses keep the same +# category keys the default-setup baseline on `main` used, so PR-vs-base +# alert comparison keeps working across the switch. +# +# Default setup must stay disabled. Re-enabling it disables this workflow and +# blocks its uploads. +name: CodeQL + +on: + pull_request: + push: + branches: [main] + schedule: + # Keep a baseline on `main` fresh even in quiet weeks, so PR comparison has + # something to diff against. Default setup ran weekly; match that. + - cron: "27 4 * * 1" + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + # Upload SARIF results. + security-events: write + # Read the workflow run context on private repos / for fork PRs. + actions: read + contents: read + strategy: + # One language failing should not mask the other language's findings. + fail-fast: false + matrix: + # `actions` scans .github/workflows and packages/ci/*/action.yml; + # `javascript-typescript` covers the TypeScript sources and the + # committed Action bundles under packages/ci/dist. + language: [actions, javascript-typescript] + steps: + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Initialize CodeQL + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + with: + languages: ${{ matrix.language }} + # Both languages are interpreted, so there is nothing to compile. + # This repo builds with Bun, which CodeQL does not drive; scanning + # sources directly is what default setup did too. + build-mode: none + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + with: + category: "/language:${{ matrix.language }}"