ci: run codeql on all prs via advanced setup - #4767
Conversation
Default setup does not run on pull requests from forks, so external contributions currently ship unscanned. Advanced setup covers them: on pull_request the analysis runs in the base repository's context, and the code scanning upload endpoint accepts results from a fork's read-only token. The bare pull_request trigger (no branches filter) preserves today's behaviour of scanning stacked PRs, whose base is not main. Languages and categories match default setup exactly, so existing alerts keep their analysis origin instead of being closed and recreated. The repository guard skips the workflow in forks, where code scanning may be unavailable; fork PRs still run, because on pull_request the guard is evaluated against the base repository. Default setup must be disabled for these uploads to be accepted - CodeQL rejects results from advanced configurations while it is on.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (8)
🔇 Additional comments (2)
WalkthroughAdded a CodeQL workflow for pushes to Merge Risk: 🔵 Low · up to The new workflow enables CodeQL scanning for pull requests, including forked contributions, but uploads will fail until CodeQL default setup is disabled for the repository. The PR is otherwise mergeable with explicit owner follow-up on that configuration change. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
1 participant
Default setup doesn't run CodeQL on pull requests from forks, so external contributions are stuck on PR checks that never come. Advanced setup fixes this.
Languages, categories and
maincoverage match the current default setup. The barepull_requesttrigger (nobranchesfilter) keeps stacked PRs scanned, whose base isn'tmain.Default setup has to be disabled in Settings -> Code security for these uploads to be accepted. Until it is, the CodeQL check here fails with
CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled.