KofTwentyTwo/gclo
2
0 Fork 0
Code Issues 28 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity

Run CodeQL for dev pushes and pull requests #45

New Issue
Closed
opened 2026-07-14 17:42:18 +00:00 by KofTwentyTwo · 0 comments
KofTwentyTwo commented 2026-07-14 17:42:18 +00:00 (Migrated from github.com)
Copy link
Copy source

Problem

The repository's contribution flow sends feature pull requests to dev, but CodeQL is configured for pushes and pull requests involving only main. Normal feature work therefore does not receive CodeQL analysis before it enters the integration branch.

Evidence

  • Contributions and pull requests target dev: CONTRIBUTING.md:13-18.
  • CodeQL push and pull-request branch filters include only main: .github/workflows/codeql.yml:9-17.

This finding was independently verified at commit 119ac26804ef93b98a262cb1c0c7a41afe71fde5. It is related to the security workflow findings collected in #32, but is tracked separately as a small, independently closable CI correction.

Acceptance criteria

  • CodeQL runs for pull requests targeting dev and main.
  • CodeQL runs for pushes to dev and main, unless duplicate analysis is deliberately avoided through an equivalent configuration.
  • The existing scheduled scan remains enabled.
  • Branch-protection documentation identifies the CodeQL check expected on normal dev pull requests.
  • A test pull request targeting dev demonstrates that the CodeQL check is created and completes.
## Problem The repository's contribution flow sends feature pull requests to `dev`, but CodeQL is configured for pushes and pull requests involving only `main`. Normal feature work therefore does not receive CodeQL analysis before it enters the integration branch. ## Evidence - Contributions and pull requests target `dev`: `CONTRIBUTING.md:13-18`. - CodeQL push and pull-request branch filters include only `main`: `.github/workflows/codeql.yml:9-17`. This finding was independently verified at commit `119ac26804ef93b98a262cb1c0c7a41afe71fde5`. It is related to the security workflow findings collected in #32, but is tracked separately as a small, independently closable CI correction. ## Acceptance criteria - CodeQL runs for pull requests targeting `dev` and `main`. - CodeQL runs for pushes to `dev` and `main`, unless duplicate analysis is deliberately avoided through an equivalent configuration. - The existing scheduled scan remains enabled. - Branch-protection documentation identifies the CodeQL check expected on normal `dev` pull requests. - A test pull request targeting `dev` demonstrates that the CodeQL check is created and completes.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
.NET
Pull requests that update .NET code
 bug
Something isn't working
 deferred
Agreed follow-up, not scheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on an action only the owner can take
 priority
Owner-flagged: work this first
 quality
Standards, simplicity, enforcement
 question
Further information is requested
 refactor
Restructuring without behavior change
 release
Release pipeline / distribution
 wontfix
This will not be worked on
No labels quality
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#45