From 95a41ed968ad929ced3f104e7ba76ca7fd4225e0 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Wed, 30 Sep 2026 09:34:41 -0400 Subject: [PATCH] ci(security): stop declaring advanced CodeQL; default setup owns it The reusable security-scan's CodeQL job ran on every push, PR and weekly schedule, and every upload it produced was refused by code scanning: Analysis upload status is failed. CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled CodeQL job status was configuration error. It still reported green, because the reusable carries continue-on-error on the Analyze step and the rejection is emitted in the post-job phase. Coverage is unchanged. Default setup runs the extended query suite, which is broader than the default suite this workflow used. Omitting `languages:` leaves the reusable's '[]' default, and its `if: inputs.languages != '' && inputs.languages != '[]'` gate skips the job rather than failing it. --- .github/workflows/security.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 98cb61ba..cc16ba86 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -33,7 +33,15 @@ jobs: if: ${{ github.actor != 'dependabot[bot]' }} uses: resq-software/.github/.github/workflows/security-scan.yml@73b9edb8f4f28a99f70ee22eb5e2dd2bf7807c84 # main with: - languages: '["actions"]' + # No `languages:` on purpose — CodeQL on this repo is GitHub's code + # scanning DEFAULT SETUP, not this workflow. While both existed the + # reusable's CodeQL job ran, then had its upload refused: + # "CodeQL analyses from advanced configurations cannot be processed + # when the default setup is enabled" (job status: configuration error) + # so every run threw its own results away. Omitting this input leaves it + # at the reusable's '[]' default, whose `if:` gate skips that job. + # Coverage is unchanged: default setup runs the `extended` query suite, + # which is broader than the default suite this workflow used. enable-semgrep: true # Pass only the secret the reusable workflow actually needs for the # opt-ins enabled above. Avoids the blanket `secrets: inherit`