ci: restore interim PR-triggered CodeQL workflow - #321
Conversation
Ruleset 18156473 (CWL Central required workflows) was assumed by commit 83ecc6e (#118) to already run ContextualWisdomLab/.github's codeql-pr.yml against every PR here, so the local codeql.yml was deleted. That assumption was verified false on 2026-09-02: this repo has had zero CodeQL PR coverage since. Fixing the ruleset itself needs org-admin access and is tracked separately; this adds a minimal, repo-local safety net in the meantime, scoped to the "actions" language this repo actually has (no first-party Python/JS-TS/Java-Kotlin code; the vendored C/C++ under packrat/lib/ is not repo-authored). Remove once the ruleset gap is fixed centrally. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughCodeQL 워크플로를 추가했습니다. ChangesCodeQL 워크플로
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🔵 Low · up to This PR restores CodeQL scanning for pull requests targeting master, but pull requests targeting main may remain uncovered if that branch is active or protected. The change is otherwise mergeable with explicit owner follow-up to confirm the required target branches and extend the workflow if needed. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
seonghobae
added
area: ci-cd
ChatGPT Codex Connector
|
Closing as redundant: the actual root-cause fix has landed. Org ruleset The gap has since been fixed at the root: an org administrator granted
Closing this interim workflow in favor of the central one, per this repo's own "remove once ruleset confirmed fixed" note in the PR description. |
1 participant
Summary
ContextualWisdomLab/.githubrequired-workflow ruleset (CWL Central required workflows, id18156473) is supposed to runcodeql-pr.ymlin every target repo's context, but it is not actually wired into that ruleset — a separate org-admin-only gap, tracked elsewhere, not fixable from this repo..github/workflows/codeql.ymlwas deleted in 83ecc6e (ci: centralize governance — remove local workflows duplicated by central .github #118) on the assumption central coverage already applied. That assumption is now verified false (2026-09-02).pull_request-triggered CodeQL workflow as an interim safety net, clearly marked for removal once ruleset 18156473 is fixed centrally.Language scope (verified, not guessed)
.c/.h/.hppfiles present are entirely underpackrat/lib/— vendored R package dependencies, not repo-authored code./language:actionsonly — never any other language.actionsonly, matching both historical precedent and the actual repo contents.What it's based on
github/codeql-actionversion/SHA pinned to matchContextualWisdomLab/.github's currentcodeql-pr.yml(v4.37.8).actions/checkoutandstep-security/harden-runnerpins reused from this repo's own existing workflows (code-quality.yml,security-audit.yml) for internal consistency — both are Dependabot-managed here.codeql-action/analyzeSARIF upload to GitHub code scanning instead.Test plan
actionlint .github/workflows/codeql.ymlpasses cleanAnalyze (actions)succeeding and uploading SARIF🤖 Generated with Claude Code
Summary by CodeRabbit
master브랜치 대상 PR 및 수동 실행을 지원합니다.