chore(codeql): reconcile bootstrap with protected main after #2147 - #2187
Merged
Conversation
…d to the head checkout Closes #2132. The pinned ghcr.io/google/osv-scanner-action:v2.5.1 image warns on every run that `--output` is deprecated in favor of `--output-file` (scanner) and `--output-files` (reporter); a bare `--output-files=<path>` defaults to the sarif format in v2.5.1 (cmd/osv-reporter/main.go: format := "sarif" unless a `format:` prefix is given), so the reporter output is byte-for-byte the same file. The exact base/head checkouts live in `source`, not the workspace root, so `upload-sarif` resolved commit identity against a non-repository and logged "does not appear to be a git repository" twice before falling back to the caller-supplied sha; `checkout_path` now names the real checkout. Contract: the new test pins the non-deprecated flags, rejects the deprecated ones, and derives the required `checkout_path` from the head checkout step's own `path:` (removing the binding makes it fail — verified RED before GREEN). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…er job One consumer, one runner: the standalone `changed-scope` job cost a second runner allocation per PR org-wide purely to compute two booleans for the `semgrep` job. The classifier now runs as a step inside `semgrep` (after harden-runner), the expensive steps gate on `steps.scope.outputs.code`, and the enforce step carries the same guard so a step-skipped scan's empty `rc` cannot fail a doc-only PR. The job keeps `if: github.event.action != 'closed'` with no needs-output term, so a doc-only run still concludes `success` (required-workflow-path-filter-boundary.md). strix.yml is left alone (hot-file collision zone). Measured in #1904; contract tests updated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The comment still said the classifier verdict was consumed through `needs`; nothing consumes it that way any more. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…sarif-checkout-path-2132
CodeRabbit on #2143: whole-workflow counts could pass if the same string appeared in another step or log line while a scanner or reporter step lost its flag. Check the four scan/retry steps and the reporter step by name. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
`gather_findings` consulted only `tool.driver.rules`, so results whose rule lives in `tool.extensions` (every current CodeQL query pack: the real Python artifact has 0 driver rules and 43 extension rules) lost their security-severity and tags and passed the Medium+ gate fail-open (#2150). - `_component_rules`: honour `result.rule.toolComponent` (index | guid | name); absent means driver; unmatched means unresolved, never the wrong component. - `_rule_for_result`: resolve inside the referenced component only, so colliding rule ids stay distinct; validate `rule.index` against the declared id; `ruleId` != `rule.id`, bad indices, non-dict entries are unresolved. - `_finding_from_result`: an unresolved reference with no result-level score gates as `level=unresolved-rule` instead of silently passing. Driver-backed behaviour unchanged. Tests RED 8 -> GREEN 24; file coverage 100%. Full suite under coverage: 3062 passed / 1 skipped / 100% coverage; 13 timing-sensitive failures reproduced as passing in isolation (CPU contention). Closes #2150 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…-extension-rules-2150
…ags-sarif-checkout-path-2132
…gate-fold-20260913
…te-extension-rules-2150 fix(codeql): resolve SARIF rules from the referenced tool component
…s-sarif-checkout-path-2132 fix(security-scan): use current OSV output flags and bind SARIF upload to the head checkout
…te-fold-20260913 fix(sast-semgrep): fold the changed-scope gate into its single consumer job
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
marked this pull request as draft
September 14, 2026 01:06
seonghobae
marked this pull request as ready for review
September 14, 2026 01:07
seonghobae
merged commit Sep 14, 2026
44901e4
into
fix/codeql-versioned-handler-bootstrap
30 of 60 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ordinary/non-force protected-base reconciliation for canonical #2106 after protected
mainadvanced fromebc69a4016f7668beaef5e3b592d378f22ada684to7f07029381a9ca770d0a68b7f3938dd652799d4dvia #2147.This reverse PR merges protected
mainintofix/codeql-versioned-handler-bootstrap; it does not replace or bypass #2106. The protected advance folds the Semgrep changed-scope gate into its single consumer and updates its own product-gap evidence. #2106 remains the canonical seven-path CodeQL bootstrap owner. Preserve both semantic deltas, use no force push/destructive rebase, and discard all predecessor check/review freshness after the resulting head changes.After merge, #2106 must reacquire exact-head/current-base workflows and independent review before normal protected integration. #2040 remains downstream and must not be reconciled ahead of #2106.