Allow CodeQL to run on demand - #24
Merged
Merged
Conversation
The workflow only had push, pull_request and schedule triggers, so there was no way to confirm a scanning config change was green without pushing a commit to provoke one. That gap is why the switch away from default setup was merged on a stale red check instead of a fresh green one.
PR #23 merged while a CodeQL check was red. The red job was the old default setup running autobuild, racing the API call that disabled it, and our own manual-build job passed on the same commit. The conclusion was right but the practice was wrong, and nothing stopped the merge: master had no protection at all. Master now requires lint, test and both CodeQL analyze jobs, must be up to date before merge, and rejects force-pushes and deletion. Administrators can still override for emergencies. Two rules protection cannot enforce go in CONTRIBUTING: never merge on a red check even when it looks stale, and confirm a fresh green run after changing CI or scanning config, because those changes take minutes to take effect on the GitHub side. CI gains a workflow_dispatch trigger so it can be verified on demand, as Security, Integration and now CodeQL already could. Release stays tag driven.
Settings has two independent default setups, Code security and Code quality, and each spawns its own CodeQL run with its own pinned Go toolchain. Both failed on Go 1.27 with the same autobuild error, which made it look like one disable had not taken effect. Record which runs come from where so the next person does not spend the same time on it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CodeQL workflow only had
push,pull_requestandscheduletriggers. There was no way to confirm a scanning config change was green without pushing a commit to provoke a run.That gap is what let #23 merge on a stale red check. The red
Analyze (go)job was the old default setup runningautobuild, racing the API call that disabled it; our ownAnalyze (go, manual)passed on the same commit. Withworkflow_dispatchthe correct move would have been to re-run scanning on demand and confirm green before merging.