From 77063bca8e933927990186452ada8e2064dfeeae Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Mon, 31 Aug 2026 12:10:58 +0200 Subject: [PATCH] ci(security): raise the codeql-gate wait from 45 to 150 minutes The gate waited 90 x 30s = 45 min for CodeQL to finish on the PR head. That is shorter than CodeQL actually takes on this repository, so the gate has been failing runs that had not failed. Measured on PR #1426, head 7b72652a: the CodeQL SAST workflow completed with conclusion=success at 17:46:05, having started at 15:41:44 -- 124 minutes. The gate step ran 16:52:58 to 17:38:44 and reported "BLOCKED: CodeQL timeout" 7 minutes and 21 seconds before the scan it was waiting for succeeded. Two open contributor pull requests are red from exactly this: #1426 and #1769, both with CodeQL completed=success on their head and every other check green. Three further PRs (#1703, #1741, #1742) are also red on codeql-gate alone, but from a different cause: the CodeQL run on their head is completed=cancelled, so the gate saw a non-success conclusion and correctly exited 1 without waiting. This change does not help those and is not intended to; they need a fresh scan, most likely having been superseded by concurrency cancel-in-progress in codeql.yml. 300 x 30s = 150 min covers the measured 124 min with margin. The job already declares timeout-minutes: 240, so the wait still cannot outlive its own job. No trigger, permission or gating change: codeql-gate blocks exactly what it blocked before, and a genuine CodeQL failure still exits 1 immediately rather than waiting out the budget. Only the absence of a verdict waits longer. Signed-off-by: Martin Vogel --- .github/workflows/_security.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/_security.yml b/.github/workflows/_security.yml index 7232d8745..dd6f3400c 100644 --- a/.github/workflows/_security.yml +++ b/.github/workflows/_security.yml @@ -42,7 +42,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 240 steps: - - name: Wait for CodeQL on current commit (max 45 min) + - name: Wait for CodeQL on current commit (max 150 min) env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | @@ -50,11 +50,17 @@ jobs: # CodeQL runs are recorded against the PR head SHA. CURRENT_SHA="${{ github.event.pull_request.head.sha || github.sha }}" echo "Waiting for CodeQL to complete on $CURRENT_SHA..." - for attempt in $(seq 1 90); do + # 300 attempts x 30s = 150 min. The previous budget was 90 x 30s = 45 min, + # which is shorter than CodeQL actually takes on this repository: a measured + # run on PR #1426 (head 7b72652a) completed with conclusion=success after + # 124 min, 7 minutes AFTER this gate had already given up. That marked at + # least five contributor PRs red for a scan that passed. The job's own + # timeout-minutes is 240, so 150 still leaves headroom. + for attempt in $(seq 1 300); do LATEST=$(gh api "repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?head_sha=$CURRENT_SHA&per_page=1" \ --jq '.workflow_runs[] | "\(.conclusion) \(.status)"' 2>/dev/null | head -1 || echo "") if [ -z "$LATEST" ]; then - echo " $attempt/90: no run yet..."; sleep 30; continue + echo " $attempt/300: no run yet..."; sleep 30; continue fi CONCLUSION=$(echo "$LATEST" | cut -d' ' -f1) STATUS=$(echo "$LATEST" | cut -d' ' -f2) @@ -63,7 +69,7 @@ jobs: elif [ "$STATUS" = "completed" ]; then echo "BLOCKED: CodeQL $CONCLUSION"; exit 1 fi - echo " $attempt/90: $STATUS..."; sleep 30 + echo " $attempt/300: $STATUS..."; sleep 30 done echo "BLOCKED: CodeQL timeout"; exit 1