From 0ed97a7dcf875664fb6539a989b738d041887dbf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 19:22:16 +0900 Subject: [PATCH] ci(codeql): restore interim PR-trigger CodeQL as safety net Central required-workflow ruleset 18156473 (ContextualWisdomLab/.github) was assumed to already run CodeQL PR on every pull request when local pull_request-triggered CodeQL was removed here in commit 6c7ae330 (PR #612, merged 2026-07-12). That assumption was verified false on 2026-09-02: the ruleset does not wire in codeql-pr.yml, leaving zero PR-head CodeQL coverage. Add pull_request back to the existing push-only codeql.yml (same verified language matrix: javascript-typescript, python) and bump github/codeql-action to v4.37.8 to match the central reference workflow. Remove this trigger once an org admin confirms ruleset 18156473 covers codeql-pr.yml (tracked separately; out of scope for this repo). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/codeql.yml | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 27c5b540f..358ce0be3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,10 +1,27 @@ name: codeql +# INTERIM SAFETY NET (added 2026-09-02, remove once org ruleset is fixed): +# PR-triggered CodeQL was removed from this repo in commit 6c7ae330 (PR #612, +# "ci: centralize governance — remove local workflows duplicated by central +# .github", merged 2026-07-12) on the assumption that the org's central +# required-workflow ruleset (id 18156473, ContextualWisdomLab/.github) already +# ran CodeQL PR on every pull request in this repo's context. On 2026-09-02 +# that assumption was verified FALSE: ruleset 18156473 does not actually wire +# in ContextualWisdomLab/.github's codeql-pr.yml, so this repo had zero +# CodeQL coverage on pull requests. The `pull_request` trigger below restores +# that coverage locally until an org admin confirms ruleset 18156473 includes +# codeql-pr.yml (tracked separately — an org:admin setting this repo-level +# workflow cannot fix), at which point this trigger should be removed again +# to avoid duplicate runs. on: push: branches: - develop - main + pull_request: + branches: + - develop + - main workflow_dispatch: permissions: @@ -32,8 +49,8 @@ jobs: - python steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} - - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 - - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + - uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8