From 1842b5524b5225adc3c6443776ff73d0c2b06242 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=BF=AE=E9=9B=A8?=
 <47820304+PeterGuy326@users.noreply.github.com>
Date: Fri, 11 Sep 2026 11:38:40 +0800
Subject: [PATCH] ci(security): run CodeQL on fork pull requests

The codeql job guard compared the head repository to the base repository, so it
was false for every fork pull request and the job was skipped. GitHub does not
evaluate a skipped job's name expression, so the skipped job published the raw
string "CodeQL (${{ matrix.language }})" and matched none of the per-language
required contexts that consumer repositories declare.

Deleting the guard leaves push, schedule, workflow_dispatch and same-repository
pull_request runs unchanged: the guard was already true for all of them.

Consumers that added a bespoke codeql-fork lane must delete it, otherwise two
jobs publish the same check name.

Refs bytefolk/.github#35
---
 workflow-templates/bytefolk-security.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/workflow-templates/bytefolk-security.yml b/workflow-templates/bytefolk-security.yml
index 3b69a2b..4de6fae 100644
--- a/workflow-templates/bytefolk-security.yml
+++ b/workflow-templates/bytefolk-security.yml
@@ -33,7 +33,6 @@ jobs:
 
   codeql:
     name: CodeQL (${{ matrix.language }})
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions: