fix(ci): keep CodeQL Action versions consistent - #728
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughPR 분석, merge preview 분석, 예약 보안 스캔에서 사용하는 CodeQL 액션을 ChangesCodeQL 액션 업데이트
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent Please review exact head |
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='8d698cf5bbf68e31ecaeb76f1b9044f7361ba5dd'
printf '%s\n' '== Checked-out commit =='
git rev-parse HEAD
git status --short
printf '%s\n' '== Pull request metadata =='
gh pr view 728 --repo ContextualWisdomLab/.github \
--json number,url,headRefOid,baseRefOid,changedFiles,files,statusCheckRollup \
--jq '{number,url,headRefOid,baseRefOid,changedFiles,files:[.files[].path],checks:[.statusCheckRollup[]|{name,status,conclusion,detailsUrl}]}'
actual_head="$(git rev-parse HEAD)"
if [ "$actual_head" != "$expected_head" ]; then
printf 'ERROR: checked-out commit is %s, expected %s\n' "$actual_head" "$expected_head" >&2
exit 1
fi
base="$(gh pr view 728 --repo ContextualWisdomLab/.github --json baseRefOid --jq .baseRefOid)"
printf '%s\n' '== Changed files and diff summary =='
git diff --name-status "$base" "$expected_head"
git diff --stat "$base" "$expected_head"
printf '%s\n' '== Exact workflow diff =='
git diff --no-ext-diff --unified=80 "$base" "$expected_head" -- \
.github/workflows/codeql-pr.yml \
.github/workflows/scheduled-security-scan.yml
printf '%s\n' '== CodeQL action pins in resulting workflows =='
rg -n -C2 'uses:\s*github/codeql-action/(init|analyze|upload-sarif)@' \
.github/workflows/codeql-pr.yml \
.github/workflows/scheduled-security-scan.yml
printf '%s\n' '== Parent and head workflow permission/SARIF/category context =='
for rev in "$base" "$expected_head"; do
printf '\n-- %s --\n' "$rev"
git show "${rev}:.github/workflows/codeql-pr.yml" | \
rg -n -C3 '^(permissions:|\s+permissions:)|upload-sarif|sarif|category:|fail|uses:\s*github/codeql-action/' || true
git show "${rev}:.github/workflows/scheduled-security-scan.yml" | \
rg -n -C3 '^(permissions:|\s+permissions:)|upload-sarif|sarif|category:|fail|uses:\s*github/codeql-action/' || true
done
printf '%s\n' '== Check runs for exact head =='
gh api "repos/ContextualWisdomLab/.github/commits/${expected_head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion,.details_url] | `@tsv`'
printf '%s\n' '== GitHub Actions runs for exact head =='
gh run list --repo ContextualWisdomLab/.github --commit "$expected_head" --limit 100 \
--json databaseId,name,workflowName,status,conclusion,event,url,startedAt,updatedAt \
--jq '.[] | [.databaseId,.workflowName,.name,.event,.status,.conclusion,.url] | `@tsv`'Length of output: 55047 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
head='8d698cf5bbf68e31ecaeb76f1b9044f7361ba5dd'
pip_job='91910729968'
printf '%s\n' '== Failed pip-audit job metadata and annotations =='
gh api "repos/${repo}/actions/jobs/${pip_job}" \
--jq '{name,status,conclusion,started_at,completed_at,html_url,steps:[.steps[]|{name,status,conclusion,number}]}' \
|| true
gh api "repos/${repo}/check-runs/${pip_job}/annotations?per_page=100" \
--jq '.[] | {path,start_line,end_line,annotation_level,message,title}' \
|| true
printf '%s\n' '== Failed pip-audit job log tail =='
gh run view 30882962649 --repo "$repo" --job "$pip_job" --log-failed 2>&1 | tail -250 || true
printf '%s\n' '== Locate CodeQL version consistency contract =='
rg -n -i -C3 \
'test_codeql_action_steps_use_one_version_per_workflow|codeql[-_ ]action.*(version|consistent)|one version per workflow' \
. \
-g '!**/.git/**' \
-g '!**/node_modules/**' \
-g '!**/dist/**' \
-g '!**/build/**' \
|| true
printf '%s\n' '== Static CodeQL action SHA consistency validation =='
python3 - <<'PY'
from pathlib import Path
import re
files = (
Path(".github/workflows/codeql-pr.yml"),
Path(".github/workflows/scheduled-security-scan.yml"),
)
pattern = re.compile(
r"^\s*uses:\s*github/codeql-action/(init|analyze|upload-sarif)@([0-9a-f]{40})\b",
re.M,
)
expected = "f205ea1c3313d32999d8d6a48b4f6530d4437b38"
for file in files:
entries = pattern.findall(file.read_text(encoding="utf-8"))
shas = {sha for _, sha in entries}
print(f"{file}: steps={len(entries)} shas={sorted(shas)}")
if not entries or shas != {expected}:
raise SystemExit(f"FAIL: {file} does not use only the expected CodeQL SHA")
print("PASS: each canonical CodeQL workflow uses only the expected immutable SHA")
PY
printf '%s\n' '== Current exact-head non-success and pending checks =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | select(.status != "completed" or (.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")) | [.name,.status,.conclusion,.details_url] | `@tsv`'Length of output: 27110
I cannot approve this head yet.
✅ Action performedReview finished.
|
|
Temporarily closing to respect dependency order and stop spending queued checks on a PR that cannot pass the current hard gate. Exact-head CodeQL, Semgrep, Security Scan, OSV, Scorecard, Secret Scan, and SBOM all succeeded, but Python Security failed because the current Strix locks still contain |
Pull request was closed
1 participant
Problem
The central default branch mixes CodeQL Action
4.37.0forinit/analyzewith4.37.4forupload-sarif. The existing repository contracttest_codeql_action_steps_use_one_version_per_workflowtherefore fails during coverage evidence for otherwise unrelated pull requests.Change
github/codeql-action/initandanalyzereference in.github/workflows/codeql-pr.ymlto the already pinned4.37.4SHA used by the workflow's related CodeQL actions;initandanalyzein.github/workflows/scheduled-security-scan.ymlto the same4.37.4SHA already used byupload-sarif;TDD / verification basis
The failing contract already exists on
main. Before the change, the exact workflow blobs contain both99df26d...(4.37.0) andf205ea1...(4.37.4). After this two-file change, each workflow uses onlyf205ea1c3313d32999d8d6a48b4f6530d4437b38for CodeQL Action steps.Current-head GitHub Actions and the existing contract test remain authoritative before merge.
Scope and supersession
Changed files only:
.github/workflows/codeql-pr.yml.github/workflows/scheduled-security-scan.ymlThis clean PR supersedes #723, whose branch also accumulated unrelated Strix dependency and cryptography lock changes. Those dependency changes are intentionally excluded from this workflow-consistency fix.
Summary by CodeRabbit