develop protection still requires retired CodeQL contexts after #1165; central CodeQL reports different names

[seonghobae]

Since protected develop@314ddeae7b775a4957594b599358c8255617eb2e (ci: consolidate repository workflow backstops, #1165, merged 2026-09-04), the branch-protection contract and the current CodeQL producer no longer agree.

Fresh live evidence — 2026-09-07

Protected develop still requires all 14 contexts, including:

Analyze (javascript-typescript)
Analyze (python)

The same protected snapshot removed the repository .github/workflows/codeql.yml that used to emit those names. The organization-required CodeQL PR workflow is live on BandScope PRs targeting the protected product branch and reports CodeQL compatibility analysis (<language>); it does not emit the retired Analyze (...) names.

On canonical Project Persistence #970 exact 46478c4aadb4f4ad4a5c4ed9821a6456be0db09d, CodeQL run 34062487160 separates two central defects from this stale-name defect. Attempt 1 detected languages successfully; CodeQL compatibility analysis (actions), (python), and (javascript-typescript) each successfully executed Request current-head CodeQL scan dispatch, then intentionally failed at Release runner or enforce current-head CodeQL verdict while awaiting the trusted handler. No authenticated terminal codeql-dispatch/<language> status appeared on that exact BandScope head. On attempt 2, all compatibility shards fail earlier because the central required workflow treats RUN_ATTEMPT != 1 as proof a prior terminal verdict should exist and emits Exact CodeQL job was rerun without an authenticated terminal verdict.

The rerun-recovery defect is canonically owned by ContextualWisdomLab/.github#1902; BandScope's exact consumer canary has been attached there. The central producer chain also has separate dispatch/template, authorization-identity, and terminal-status publication owner paths (.github#1925/#1927/#1929/#1991). These failures remain fail closed. They are independent of the BandScope protection-name drift: even after the central verdict path is repaired, the retired Analyze (...) required contexts stay unsatisfiable until this repository's protection contract is migrated.

There is also a repository-source consistency defect: docs/security/github-required-checks.md on protected develop still lists the two retired Analyze (...) names as the intended develop and main contexts while simultaneously saying the organization/default CodeQL owner is authoritative. The setting mutation and documentation update must land as one rollout contract.

Foundation and repository-source repair

Canonical inherited-base formatter repair #1176 current exact head is 8488a02a1b36a99c94b3e248e948d754ed446750. Its tree is byte-identical to semantic repair head a7b0030a3a6cc6296a19ba3f8eaf595d470d05bd; 340b0a343ecfc05f630c7da729b8af40c7da4a2c and 8488a02a… are empty Trigger CI retry descendants. The PR still changes exactly one file, services/analysis-engine/tests/test_supply_chain_policy.py, with only the repository-pinned Ruff formatting delta. Exact 8488a02a… has terminal-success ci, build-baseline, and sbom; Security Scan, SAST Semgrep, and central CodeQL are still queued. Review threads are empty and formal review inventory is empty, so #1176 remains Draft.

Draft PR #1183 owns the repository-source half. Its exact source head remains c0db8829873b0bff8efa25371dc4ee76bf6ff3a5, stacked on #1176's semantic tree by ordinary non-force ancestry with one semantic file: docs/security/github-required-checks.md. The later #1176 retry commits change no tree bytes and create no semantic restack requirement. After #1176 normally merges, #1183 must be retargeted to fresh protected develop, materialize fresh exact-head repository/central checks, and only then proceed with the admin-side setting rollout.

Root cause

#1165 correctly removed the repository-owned PR CodeQL workflow as part of workflow consolidation, but the classic branch-protection required-context list and the repository's intended-check documentation were not migrated in the same change. GitHub matches required checks by emitted check-run context name, so the two retired names remain unsatisfiable even if central CodeQL ultimately succeeds.

This is a branch-protection/configuration defect plus distinct central-dispatch/verdict defects, not a reason to weaken CodeQL coverage or reconstruct a repository-local scanner.

Required repair

Preserve the central CodeQL security gate and migrate the two stale BandScope required contexts from:

Analyze (javascript-typescript)
Analyze (python)

to the exact current central job contexts:

CodeQL compatibility analysis (javascript-typescript)
CodeQL compatibility analysis (python)

After #1176 merges, retarget #1183 to fresh protected develop, obtain exact-head checks/review, and land its documentation update in the same rollout as the admin-side protection mutation. Independently, central .github owners must complete the current-head native scan / authenticated terminal-verdict chain so the new compatibility contexts can actually reach terminal success.

Do not solve this by deleting CodeQL from branch protection, restoring a second repository PR scanner solely to manufacture legacy names, creating a pass-through success job, synthesizing statuses, or bypassing branch protection.

Prevention / owner path

ContextualWisdomLab/.github#1923 is the central required-context-name guard owner; it protects against future producer job-name drift. ContextualWisdomLab/.github#1902 is the current rerun-recovery owner for missing authenticated terminal verdicts. The prevention invariant is that central job rename/removal, consumer required-context migration, code-current intended-check documentation, and an actually functioning exact-head verdict producer are treated as one rollout rather than independent cosmetic changes.

Closure criteria

• repair(ci): format consolidated supply-chain policy test #1176 is normally merged after exact-head required checks and then-live review policy are satisfied without self-approval or fabricated evidence.
• docs(ci): align intended CodeQL contexts with central owner #1183 is retargeted to fresh protected develop and receives fresh exact-head repository/central checks plus review evidence required by then-live policy.
• develop no longer requires the two retired Analyze (...) contexts.
• develop requires the two exact current central CodeQL compatibility contexts.
• docs/security/github-required-checks.md names the same current contexts and ownership model.
• The central current-head scan/verdict path is repaired so an unchanged BandScope PR head receives authenticated terminal-success JavaScript/TypeScript and Python compatibility contexts.
• No repository-local duplicate CodeQL PR scanner or synthetic pass-through status is introduced.
• Fresh branch-protection, source-document, and exact-head check evidence are attached before closing.

[seonghobae]

Fresh 2026-09-06 consumer sweep reconfirms the configuration defect on unchanged protected authority. develop is still protected at 314ddeae7b775a4957594b599358c8255617eb2e and still requires exactly 14 contexts, including retired Analyze (javascript-typescript) and Analyze (python). No repository-local duplicate CodeQL PR scanner has been restored. Current open Draft owner heads are therefore kept non-ready; this stale protection contract is not being bypassed or treated as an Actions-queue failure. The accepted repair remains exact branch-protection migration to CodeQL compatibility analysis (javascript-typescript) and CodeQL compatibility analysis (python), followed by unchanged-head terminal evidence. The available GitHub application connection exposes branch-protection reads but no administration mutation, so this run can attach exact consumer evidence but cannot safely mutate the protected-context list itself.

[seonghobae]

Escalating: this repository is frozen, and unlike the sibling cases there is no bypass available.

Re-measured today, 2026-09-06.

enforce_admins is true here

branches/develop/protection
  enforce_admins   true
  strict           true
  required         14 contexts, of which
                     Analyze (javascript-typescript)   <- nothing produces this
                     Analyze (python)                  <- nothing produces this
  CodeQL default setup   not-configured

The other two repositories with this class of defect (.github, contextual-orchestrator) both have enforce_admins = false, and merges have continued there by bypassing protection. That route does not exist in this repository. Protection here is being enforced exactly as configured, against a requirement that cannot be satisfied.

The breaking commit was the last one through

Last merge into develop:

314ddeae   2026-09-04T09:48:51Z   ci: consolidate repository workflow backstops (#1165)

That is #1165 — the commit that removed codeql.yml. Nothing has merged since. It sealed the door behind itself, and the repository has been closed for roughly two days against ~196 open pull requests.

Verified at a live head

#1139 at 0cab3700: 12 of the 14 required contexts are present and passing; the two Analyze (…) contexts are absent — not failing, absent. mergeable_state = blocked, with no failing check to point at.

One correction to something I said elsewhere

I have been reporting a separate finding that strict = true makes protection unsatisfiable while a default branch moves quickly. That does not apply here, and the difference matters for this issue: develop is not moving at all (0 merges in 24h), so a branch here can be green and up to date at the same time. Restoring the two contexts — or removing them from protection — is sufficient to unblock this repository. No deeper change is needed, unlike in .github where the merge rate is the binding constraint.

That makes this the cheapest of the three fixes and the one with the largest immediate effect.

Unchanged from the original report: which direction to take (enable CodeQL default setup so the Analyze (…) contexts are produced again, or drop them because CodeQL now runs centrally under different names) is a policy call, and branch protection is an authorization boundary, so I have not changed it.

[seonghobae]

Closing the remaining objection: no workflow in this repository can produce those two contexts.

The natural challenge to the report above is that some other workflow might declare a job reporting Analyze (javascript-typescript) / Analyze (python), making the absence incidental rather than structural. It cannot.

Parsing every workflow on develop with a YAML parser — job name: where present, job id otherwise, which is exactly how GitHub derives a check-run name:

workflows on develop   build-baseline.yml  ci.yml  ossf-scorecard.yml
                       release.yml  sbom.yml  security-audit.yml
codeql.yml             absent (404)

jobs whose effective check-run name mentions "analyze" or "codeql":   0

So the two required contexts have no producer of any kind: the workflow that used to report them was deleted by #1165, no surviving workflow declares a replacement, and CodeQL default setup — the other mechanism that emits Analyze (…) checks — is not-configured.

Re-confirmed at the same time, unchanged: enforce_admins = true, strict = true, 196 open pull requests, and develop still at 314ddeae from 2026-09-04.

One consequence worth stating explicitly, because it is easy to assume otherwise: the central dispatch-identity defect tracked in ContextualWisdomLab/.github#1929 is a real problem, but fixing it will not unblock this repository. That dispatch produces contexts named CodeQL compatibility analysis (…). Protection here requires Analyze (…), which is CodeQL default setup's naming convention. Different names, different producer. This repository needs its own protection list corrected, or default setup enabled — nothing upstream substitutes for that.

I checked this with a parser rather than a text search after getting a related audit wrong earlier today by matching strings instead of parsing YAML.