chore(ci): correct CodeQL pinned-version annotations - #33
Merged
Merged
Conversation
Annotate the existing cdf488f595d80d6e07e03d4674febd5ab45fa938 pin as v4.37.9. The action SHA and executable workflow configuration are unchanged.
Bindy-lbb
approved these changes
Sep 14, 2026
Bindy-lbb
left a comment
Bindy-lbb
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. 两处改动：
- codeql-action 注释版本号更新：
v4.37.4→v4.37.9，SHA pin 不变（cdf488f595d80d6e07e03d4674febd5ab45fa938），只是注释对齐实际版本，安全无影响。 - scorecard upload-sarif 注释同步更新：同上，SHA 不变，注释更新。
SHA 固定 pin 是最佳实践，注释版本号仅供人类识别，本次变更纯粹是文档对齐。✅
PeterGuy326
added a commit
that referenced
this pull request
Sep 14, 2026
## What this changes
One line deleted from `workflow-templates/bytefolk-security.yml` — the
`if:` guard on the `codeql` job. Nothing else in the template changes.
```diff
codeql:
name: CodeQL (${{ matrix.language }})
- if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
runs-on: ubuntu-24.04
```
Blob size goes 1979 -> 1858 bytes. The deleted line is exactly 121 bytes
including its newline, so the arithmetic accounts for the whole delta.
The double-quoted `cron`, the `# Change this list to the languages
present in the repository.` comment, the single-language matrix, the
ungated `Autobuild` step and every pinned action SHA are untouched.
## Why
The guard's second clause compares the head repository to the base
repository, so it is false for every fork pull request and the `codeql`
job is skipped. GitHub does not evaluate a skipped job's `name:`
expression, so the skipped job publishes the raw string `CodeQL (${{
matrix.language }})` as its check name and matches none of the
per-language contexts consumers declare as required.
Every repository that adopted this template inherited that behaviour.
The full evidence, the mechanism and the rejected alternatives are
recorded in #35 rather than repeated here.
The consumer-side fix is bytefolk/mem#205, which deletes the same line
from mem's copy. That PR is same-repository, so its own three CodeQL
contexts can demonstrate the fix working. This template PR is filed
separately so the fix propagates on the next template sync instead of
regressing.
## Why deleting the guard rather than documenting a second `codeql-fork`
lane
`bytefolk/digital-employee#250` worked around this by adding a second
job with the inverted guard. That job is identical to the baseline
`codeql` job apart from the guard and the language matrix, so a second
lane duplicates roughly 37 lines to express what deleting one line
already says — and it has to be re-duplicated in every consumer.
The guard is provably redundant for every trigger other than a fork PR:
- `push`, `schedule`, `workflow_dispatch` — the first clause
`github.event_name != 'pull_request'` is already true.
- Same-repository `pull_request` — the second clause is already true.
- Fork `pull_request` — the job was skipped; it now runs. **This is the
only behavioural change.**
Fork `pull_request` runs can carry this job: `digital-employee#250`'s
`codeql-fork` concluded `success` on a fork PR while declaring
`permissions: security-events: write` and containing no
`continue-on-error`, which means the `Analyze` step succeeded — and
`codeql-action/analyze` returns HTTP 403 without that permission. Fork
runs still get no secrets and read-only `contents`. All ByteFolk
repositories are public, so the private-repository restriction on
fork-PR permissions does not apply here.
## Tradeoff, stated plainly
Consumers that adopt the corrected template will build untrusted fork
code in a job holding `security-events: write`. Those runs have no
secrets and read-only `contents`, and the other baseline jobs already
build the same untrusted code, so this adds no new class of exposure. It
is the posture GitHub's own default CodeQL setup takes for public
repositories.
Adopting this is a per-repository decision, not an automatic one: the
template only changes what a consumer gets the next time it syncs, and a
consumer that wants the old behaviour can keep its guard.
## Consumer follow-up required
Any consumer that added its own `codeql-fork` lane must delete it once
it adopts this template, otherwise two jobs publish the same check name.
Today that is `digital-employee` via #250. This PR deliberately does not
touch `digital-employee`; that removal belongs in its own reviewable
change against that repository.
## Interaction with #33
#33 edits this same file, but only the three `github/codeql-action/*`
annotation lines (`# v4.37.4` -> `# v4.37.9`) plus
`bytefolk-scorecard.yml`. This PR deletes the guard line above them. The
hunks do not overlap, so the two 3-way-merge cleanly in either order,
and #32's AC-003 requirement that annotation changes not be mixed into
unrelated PRs is preserved in both directions.
## What this does not touch
- No `permissions:` block changes. The `codeql` job keeps exactly
`contents: read`, `actions: read`, `packages: read`, `security-events:
write`.
- No required status context, branch protection rule or ruleset is
weakened or removed, in this repository or any consumer.
- No action SHA, trigger, matrix entry, step or job other than the
deleted line.
- No annotation correction; those stay in #33.
Refs #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical requirement
Refs #32
Decision reference: the initial R1 Issue body. It explicitly records that local candidates preceded this prospective publication record; no retrospective approval is claimed.
Requirement trace
File domains
workflow-templates/bytefolk-scorecard.yml(47);workflow-templates/bytefolk-security.yml(57, 63, 66).Base:
0aaff626914385ad8acd20cb2b7b47e300417a68Head:
b271c9292060c754925ecef586fd1d8857818f93Scope and non-goals
Correct only
# v4.37.4to# v4.37.9on CodeQL uses-lines pinned tocdf488f595d80d6e07e03d4674febd5ab45fa938. The official tag object resolves to that existing pin. Action SHAs, permissions, triggers, steps, matrices, other pins, and runtime code are unchanged.Validation
ruby evidence/verify.rb --baselineandruby evidence/verify.rb --committedfrom the retained review packet;git diff --check 0aaff626914385ad8acd20cb2b7b47e300417a68 b271c9292060c754925ecef586fd1d8857818f93from this repository.The strict verifier checks the changed-file allowlist; exact old blobs and line inventory; complete expected-byte replacement; absence of stale target annotations; parsed YAML equality; comment-stripped byte equality and SHA-256 digests; whitespace and unchanged modes; one commit with the exact parent; and clean worktrees with no untracked files. All passed. The independent replay is recorded in canonical R1. The verifier and inventory are retained outside repository commits.
ruby evidence/verify.rb --committedSecurity and compatibility
Documentation annotation only. No dependencies, permissions, credentials, data flows, or runtime behavior change. The diff and commit identity were inspected for public-safe content. No CHANGELOG entry or behavior-documentation update is needed because only explanatory comments change.
Known limitations
Runtime suites, build, coverage, and dependency audits were not rerun for this comment-only change; no runtime test result is claimed. Hosted CI is separate from local equality proof. This is a draft, not merge-ready.
Risk and rollback
Low-risk annotation correction. Roll back through an ordinary revert of this single commit. There is no migration or release action.
Product review handoff