fix(codeql): restore required workflow startup recovery - #1856
Conversation
Signed-off-by: Seongho Bae <me@seonghobae.me>
…tartup-materialization
|
Warning Review limit reachedNext included review available in 49 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (11)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc38e19338
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ruleset `18156473` still omitted the now-safe entrypoint. Completion therefore | ||
| requires protected-main audit/recovery contracts, a live ruleset re-add that | ||
| preserves every unrelated field, and fresh exact-head runs that do not conclude | ||
| `startup_failure`; configuration text alone is not completion evidence. |
There was a problem hiding this comment.
This correction makes the live status “re-admission in progress” and requires a ruleset update plus fresh exact-head evidence, but the same baseline still states at docs/product-technical-gap-baseline.md:3115 that “Item 41 is therefore fixed.” Because agents are directed to treat this document as the live gap snapshot, these opposing statuses can cause the required ruleset re-add or verification to be skipped; supersede or qualify the later completion claim as part of this update.
AGENTS.md reference: AGENTS.md:L3-L4
Useful? React with 👍 / 👎.
| # while still being validated from an organization-admin ruleset payload. | ||
| REQUIRED_EXCLUSION_PROBES = {".github", "noema"} | ||
| REQUIRED_WORKFLOW_PATHS = ( | ||
| ".github/workflows/codeql-pr.yml", |
There was a problem hiding this comment.
When this newly required entrypoint runs on a repository with more than one detected language—for example, a Python repository with .github/workflows, because actions is also added—codeql-pr.yml sends one separate repository_dispatch run per matrix shard, while .github/workflows/codeql-scan-dispatch.yml:25-30 puts every language for the same repository and PR in one cancel-in-progress group. Those runs therefore cancel or replace one another, leaving all but one required shard without a status and causing them to fail or poll for 180 minutes; include the language in the dispatch concurrency key before adding this workflow to the required set.
Useful? React with 👍 / 👎.
| # while still being validated from an organization-admin ruleset payload. | ||
| REQUIRED_EXCLUSION_PROBES = {".github", "noema"} | ||
| REQUIRED_WORKFLOW_PATHS = ( | ||
| ".github/workflows/codeql-pr.yml", |
There was a problem hiding this comment.
The re-admitted workflow's detector at .github/workflows/codeql-pr.yml:74-90 only emits shards for Actions, JavaScript/TypeScript, Python, and Java/Kotlin. A repository whose application code is Go, C/C++, C#, Ruby, or Swift therefore gets no shard for that code, even though these are supported CodeQL languages and the repository-local bootstrap already maps them in scripts/ci/bootstrap_codeql_pull_requests.py:109-121; the new required gate consequently provides no Medium+ merge protection for the affected source language. Reuse the complete canonical language mapping before adding this workflow to the organization-wide required inventory.
Useful? React with 👍 / 👎.
1 participant
Summary
Root cause
The live repository-scoped organization ruleset omitted
.github/workflows/codeql-pr.yml, while central audits and scheduler logic preserved that omission. Exact-tree restamps therefore materialized the other required workflows but never created a CodeQL PR run.The existing CodeQL entrypoint is safe for required-workflow use: it dispatches trusted native analysis and polls app-authored check evidence; it does not invoke
github/codeql-actionitself.PR #1818 is complementary documentation about default-setup conflicts and has no runtime ruleset, materialization, or startup-recovery code to inherit.
Verification
python -m pytest -q tests/test_central_required_workflow_exact_inventory.py tests/test_central_required_workflow_ruleset_audit.py tests/test_code_scanning_required_workflow_contract.py tests/test_codeql_scan_dispatch_workflow_contract.py tests/test_pr_review_merge_scheduler.py(352 passed)python -m pytest -q(2813 passed, 1 skipped, 21 subtests passed)actionlint -no-color .github/workflows/codeql-pr.yml .github/workflows/codeql-scan-dispatch.yml .github/workflows/pr-review-merge-scheduler.ymlgit diff --check origin/main...HEADLive acceptance remains: merge this trusted-base change, add only CodeQL PR to ruleset 18156473, exact-tree restamp the seven target PRs, and verify each new exact head creates a non-startup-failure CodeQL PR run.