Repository navigation
ci: scan fork pull requests with CodeQL - #220
Merged
Merged
Conversation
synackd
force-pushed
the
ci/fix-codeql
branch
from
October 23, 2026 22:31
ace4c00 to
e4dfbd8
Compare
synackd
marked this pull request as ready for review
October 23, 2026 22:39
synackd
force-pushed
the
ci/fix-codeql
branch
from
October 26, 2026 15:52
e4dfbd8 to
3b1e4e4
Compare
seantronsen
self-requested a review
October 26, 2026 17:03
seantronsen
previously approved these changes
Oct 26, 2026
Contributor
|
This might be good to add into the actions repo at some point. I've created OpenCHAMI/github-actions#57 to track it, but I have to focus on getting v4 and the signing stuff out the door first. |
Replace default setup with an explicit workflow so fork pull requests produce the CodeQL results required by the merge ruleset. Default setup excludes forks, leaving their code scanning gate waiting indefinitely. Scan Go, Python, and GitHub Actions on pull requests and main pushes, and schedule weekly scans to refresh results as queries evolve. Allow manual runs to establish or refresh the main branch baseline. Build Go packages with the toolchain declared in go.mod. Pin actions to commit hashes and use the pull_request event so fork analysis can upload results with a read-only token without privileged fork execution. Add the setup guide beside the workflow to explain the migration to advanced setup, baseline verification, and recovery of existing fork pull requests. Disable default setup during deployment because it blocks uploads from explicit CodeQL workflows. Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
synackd
force-pushed
the
ci/fix-codeql
branch
from
October 26, 2026 17:57
3b1e4e4 to
2664448
Compare
seantronsen
reviewed
Oct 26, 2026
Collaborator
Author
|
Whew... Third time is the charm retrying the coverage job. Anyhow, thanks for the review! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fork pull requests can wait indefinitely for CodeQL results: GitHub's default setup excludes forks, while this repository's Pass CI before merge ruleset requires CodeQL analysis. PR #214 exhibited this behavior without any CodeQL run for its head or merge commit.
Add an explicit CodeQL workflow that scans Go, Python, and GitHub Actions on pull requests targeting
main, pushes tomain, and a weekly schedule. Allow manual runs to refresh the baseline. Usepull_requestso fork scans can upload results with a read-only token, install Go fromgo.mod, build all Go packages, and pin actions to commit hashes.Add
.github/workflows/codeql.mdalongside the workflow to explain the cause, migration to advanced setup, baseline verification, and recovery steps for existing fork PRs.Deployment
mainto establish the baseline. The initial migration may require the existing administrator bypass if CodeQL blocks it.mainand approve contributor workflow runs when prompted.Keep the existing CodeQL ruleset requirement enabled. No additional fork token permissions are needed.
Validation
reuse lint-file), andgit diff --checkpassed..github/workflows/codeql.md.Checklist
make test(or equivalent) locally and all tests passgit commit -s) with my real name and email<filename>.licensesidecar (not applicable)LICENSES/directoryType of Change