Skip to content

fix(actions): pin security.yml jobs off starved floating ubuntu-latest - #1072

Draft
seonghobae wants to merge 3 commits into
mainfrom
fix/pin-security-codeql-workflows-ubuntu-2404
Draft

fix(actions): pin security.yml jobs off starved floating ubuntu-latest#1072
seonghobae wants to merge 3 commits into
mainfrom
fix/pin-security-codeql-workflows-ubuntu-2404

Conversation

@seonghobae

@seonghobae seonghobae commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Current exact boundary

  • protected base: main@a080297d2546bb61e89520d637cabc202db331ec
  • exact head: 730801abfc53d46fb377c1be8b48857d89f6588c
  • compare: ahead_by=3, behind_by=0; effective protected-base delta remains exactly 3 files
  • lifecycle: Draft / non-force descendant restack complete / exact-head gates pending

Valid intent

The repo-local .github/workflows/security.yml still used floating ubuntu-latest for all three local quality/security jobs. Central .github#1870 already established the same defensive pin pattern for required review infrastructure after a live 30-run sample found 14 queued and 0 clean successes. This PR applies that already-reviewed owner pattern locally without claiming runner-image pinning can cure the current hosted-capacity backlog.

Changes retained after restack

  • .github/workflows/security.yml: all 3 runs-on values are explicit ubuntu-24.04.
  • tests/test_repository_security_metadata.py: requires exactly three ubuntu-24.04 jobs and rejects ubuntu-latest in this workflow.
  • CHANGELOG.md: records the local defensive runner pin under 0.2.0 - Unreleased.

Non-force restack evidence

Protected main advanced by #1073 from the original PR base 2e414d15... to a080297d.... #1073 changes nim_benchmark source/docs/tests and does not overlap this PR's three-file delta. The branch was advanced with a normal two-parent descendant commit, preserving both histories; no force-push or destructive rebase was used. Fresh compare from current protected main to this head is behind_by=0, and the only effective files remain the workflow, its repository contract test, and CHANGELOG.

Exact-head gates

The CodeQL "compatibility analysis" checks on this PR follow a known dispatch-and-poll design: a job dispatches a codeql-scan event to .github, polls for an authenticated verdict, and deliberately exits non-zero with "pending" until the dispatch workflow republishes a terminal verdict and reruns this exact job itself — self-resolving, not a real failure requiring a fix here.

Keep Draft until current-head required checks, review, and thread gates are terminal-valid. Do not use no-op retriggers, bypass merge, self-approval, or gate weakening.

Generated by Claude Code

@claude
fix(actions): pin security.yml jobs off starved floating ubuntu-latest
12ffcee 
Live GitHub Actions queue audit while investigating hours-long queued
checks on other PRs found that this repo's own security.yml (Tests and
package quality, Property and coverage-guided fuzzing, CodeQL/supply
chain/SBOM) still requests the unpinned floating ubuntu-latest image.
ContextualWisdomLab/.github already root-caused and fixed this exact
starvation pattern for its central required review workflows in #1870;
this repo's own security.yml was outside that fix's scope. Pin all 3
jobs to ubuntu-24.04 as defensive, evidence-based consistency with the
established org pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPmJErfkcHer4UVEgrQxUX
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-05T05:35:26.134692Z bf5df1d New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 65e770fe-f08d-47e0-9594-c77982539f50

📥 Commits

Reviewing files that changed from the base of the PR and between 2e414d1 and 12ffcee.

📒 Files selected for processing (3)
  • .github/workflows/security.yml
  • CHANGELOG.md
  • tests/test_repository_security_metadata.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

보안 워크플로의 세 작업이 ubuntu-24.04를 사용하도록 고정되었습니다. 관련 테스트는 고정된 러너 세 개와 ubuntu-latest 미사용을 검증합니다. 변경 이력에도 이 변경이 기록되었습니다.

Changes

보안 워크플로 러너 고정

Layer / File(s) Summary
보안 작업 러너 및 검증 갱신
.github/workflows/security.yml, tests/test_repository_security_metadata.py, CHANGELOG.md		 tests, fuzz, security 작업의 runs-on 값을 ubuntu-24.04로 변경했습니다. 테스트는 해당 값이 세 번 사용되고 ubuntu-latest가 없음을 확인합니다. 변경 이력에 고정 내용을 추가했습니다.

Estimated code review effort: 1 (매우 낮음) | ~5분

Merge Risk: ⚪ Minimal · up to 12ffc

Security workflow jobs now use the explicit Ubuntu 24.04 runner, with matching metadata coverage and changelog documentation. No current merge-readiness risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 security.yml의 세 작업에서 ubuntu-latest를 ubuntu-24.04로 고정한 주요 변경을 정확하게 설명합니다. 간결하고 구체적입니다.
Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/pin-security-codeql-workflows-ubuntu-2404

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

claude and others added 2 commits September 5, 2026 05:33
@claude
docs(tests): add docstring to security-workflow contract test
bf5df1d 
Small follow-up per CodeRabbit's diff-scoped docstring check on #1072:
the test function this PR's assertion change lives in never had a
docstring on main. This repo's own interrogate gate excludes tests/
(pyproject.toml), so this isn't a required-check fix -- just cleaning
up the one warning CodeRabbit's real review flagged for a fully green
pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KPmJErfkcHer4UVEgrQxUX
@seonghobae
Merge protected main into runner-image pin
730801a
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 5, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@seonghobae
seonghobae marked this pull request as draft September 5, 2026 06:08
@seonghobae Claude

seonghobae commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Coordination note, not an action needed from anyone right now: this PR's .github/workflows/security.yml diff (pinning the 3 runs-on: ubuntu-latest jobs to ubuntu-24.04) touches the same file as two open Codex-authored PRs I found while surveying current work to avoid duplicate effort — #1066 ("remove the main-only branch filter so stacked PRs get CodeQL + Python supply-chain checks") and its apparent predecessor #1060. Both change the pull_request:/if: trigger logic in the same jobs this PR only touches runs-on: for, so they shouldn't semantically conflict, but they will likely produce a textual merge conflict on the same hunks whichever lands second. #1066 is itself currently Draft/blocked (waiting on #1069's NIM-evidence refresh, then a restack onto main), so this isn't urgent — just flagging it here now so whoever restacks second does a real merge (never a force-push/rebase-away) rather than being surprised by it.

Generated by Claude Code

This was referenced Sep 5, 2026
Open
Draft
Open
@seonghobae seonghobae added bug Something isn't working priority: high status: draft type: bug Defect or incorrect behavior labels Sep 7, 2026 — with ChatGPT Codex Connector
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bug Something isn't working priority: high status: draft type: bug Defect or incorrect behavior

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@seonghobae @claude