From 6b6ecf271257e38b721ebd811fb3956ec1d04a1b Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Mon, 31 Aug 2026 11:17:05 +0200 Subject: [PATCH] ci(security): raise the codeql-gate wait from 45 to 150 minutes The gate waited 90 x 30s = 45 min for CodeQL to finish on the PR head. That is shorter than CodeQL actually takes on this repository, so the gate was failing runs that had not failed. Measured on PR #1426, head 7b72652a: the CodeQL SAST workflow completed with conclusion=success at 17:46:05, having started at 15:41:44 -- 124 minutes. The gate step ran 16:52:58 to 17:38:44 and reported "BLOCKED: CodeQL timeout" 7 minutes and 21 seconds before the scan it was waiting for succeeded. Five open contributor pull requests (#1426, #1703, #1741, #1742, #1769) are red on security / codeql-gate alone, with every other check green, for scans that passed. Those authors did nothing wrong. 300 x 30s = 150 min covers the measured 124 min with margin. The job already declares timeout-minutes: 240, so the wait still cannot outlive its own job. No trigger, permission or gating change: codeql-gate blocks exactly what it blocked before, and a genuine CodeQL failure still exits 1 immediately rather than waiting out the budget. Signed-off-by: Martin Vogel --- .github/workflows/_security.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/_security.yml b/.github/workflows/_security.yml index 7232d8745..dd6f3400c 100644 --- a/.github/workflows/_security.yml +++ b/.github/workflows/_security.yml @@ -42,7 +42,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 240 steps: - - name: Wait for CodeQL on current commit (max 45 min) + - name: Wait for CodeQL on current commit (max 150 min) env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | @@ -50,11 +50,17 @@ jobs: # CodeQL runs are recorded against the PR head SHA. CURRENT_SHA="${{ github.event.pull_request.head.sha || github.sha }}" echo "Waiting for CodeQL to complete on $CURRENT_SHA..." - for attempt in $(seq 1 90); do + # 300 attempts x 30s = 150 min. The previous budget was 90 x 30s = 45 min, + # which is shorter than CodeQL actually takes on this repository: a measured + # run on PR #1426 (head 7b72652a) completed with conclusion=success after + # 124 min, 7 minutes AFTER this gate had already given up. That marked at + # least five contributor PRs red for a scan that passed. The job's own + # timeout-minutes is 240, so 150 still leaves headroom. + for attempt in $(seq 1 300); do LATEST=$(gh api "repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?head_sha=$CURRENT_SHA&per_page=1" \ --jq '.workflow_runs[] | "\(.conclusion) \(.status)"' 2>/dev/null | head -1 || echo "") if [ -z "$LATEST" ]; then - echo " $attempt/90: no run yet..."; sleep 30; continue + echo " $attempt/300: no run yet..."; sleep 30; continue fi CONCLUSION=$(echo "$LATEST" | cut -d' ' -f1) STATUS=$(echo "$LATEST" | cut -d' ' -f2) @@ -63,7 +69,7 @@ jobs: elif [ "$STATUS" = "completed" ]; then echo "BLOCKED: CodeQL $CONCLUSION"; exit 1 fi - echo " $attempt/90: $STATUS..."; sleep 30 + echo " $attempt/300: $STATUS..."; sleep 30 done echo "BLOCKED: CodeQL timeout"; exit 1