From 0866d51a148d0a1a32d966fb953ce567ce9c4d11 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Wed, 30 Sep 2026 09:34:39 -0400 Subject: [PATCH] ci(security): stop declaring advanced CodeQL; default setup owns it The reusable security-scan's CodeQL job ran on every push, PR and weekly schedule, and every upload it produced was refused by code scanning: Analysis upload status is failed. CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled CodeQL job status was configuration error. It still reported green, because the reusable carries continue-on-error on the Analyze step and the rejection is emitted in the post-job phase. Coverage is unchanged. Default setup runs the extended query suite, which is broader than the default suite this workflow used. Omitting `languages:` leaves the reusable's '[]' default, and its `if: inputs.languages != '' && inputs.languages != '[]'` gate skips the job rather than failing it. --- .github/workflows/security.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 2879267..ff55046 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -2,8 +2,7 @@ # SPDX-License-Identifier: Apache-2.0 # # Thin caller for the org-wide reusable security-scan workflow in -# resq-software/.github. Update the `languages` list to match this repo's -# primary code; everything else inherits. +# resq-software/.github. Everything inherits from the reusable's defaults. name: security @@ -34,7 +33,15 @@ jobs: if: ${{ github.actor != 'dependabot[bot]' }} uses: resq-software/.github/.github/workflows/security-scan.yml@44987ffd6eb5b1aa9d0a0d39e8dde9d669fe1d84 # main with: - languages: '["actions"]' + # No `languages:` on purpose — CodeQL on this repo is GitHub's code + # scanning DEFAULT SETUP, not this workflow. While both existed the + # reusable's CodeQL job ran, then had its upload refused: + # "CodeQL analyses from advanced configurations cannot be processed + # when the default setup is enabled" (job status: configuration error) + # so every run threw its own results away. Omitting this input leaves it + # at the reusable's '[]' default, whose `if:` gate skips that job. + # Coverage is unchanged: default setup runs the `extended` query suite, + # which is broader than the default suite this workflow used. enable-semgrep: true # Forward only the named secrets the reusable workflow declares, instead # of `secrets: inherit` (which hands it ALL of this repo's secrets and