fix(codeql): accept queued pre-cutover scan-dispatch payloads - #2009
Merged
Conversation
#2008 made required_jobs mandatory on the default-branch handler. repository_dispatch runs that file, so payloads that lined up before the merge still carry required_language + required_job_id and a one-shard matrix. Validate now synthesizes required_jobs from those scalars when the array is empty, the matrix length is 1, and the language matches. A present required_jobs array still wins; missing or mismatched identity still fails closed. Concurrency stays {workflow}-{repository}-{PR} with no language suffix. Developer experience: queued single-language dispatches validate instead of all failing closed after the cutover. User experience: required CodeQL compatibility checks for those in-flight PRs can still complete.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reachedNext included review available in 37 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
Bypass merge evidence (chicken-and-egg, structural workflow repair, not a product change).
|
This was referenced Sep 7, 2026
seonghobae
added a commit
that referenced
this pull request
Sep 7, 2026
…ed claim Three review findings on the Actions ceiling section, all valid. The heading read `2026-09-07` while the only measurement window in the section is `2026-09-06T12:00:00Z..19:00:00Z` and the other reference is 2026-09-04. The commit was `2026-09-07 05:07 +0900` = `2026-09-06T20:07Z`, so the heading carried the local calendar date rather than the measurement's. KST rolls the date nine hours before UTC; date a measurement section by the measurement. The planning sentence said `#1929` converts "368 cheap no-ops per 7 h" while the measurement two sentences above is 354, which is also the figure the 20.9% ratio is computed from (354/1691). 368 appears nowhere else in the document as a measured value. The sentence now names the same 354 explicitly, so the two cannot drift apart again. The two fenced blocks this section added carried no language info string (MD040). Both are now `text`, matching the document's existing precedent. Three further bare blocks predate this change and are left alone: no markdownlint gate runs in this repository, so this is consistency with the reviewer's point inside this change's own scope rather than a document-wide sweep. Verifying the third finding showed the section's own "not duplicates" reasoning has expired: `#2008` removed `required_language` from the dispatch concurrency group, which was still language-keyed at `2396ddca`, the last `main` inside the measured window. The replacement paragraph records that, the measured collapse that followed (`06:16Z..08:15Z`: 86 of 100 runs cancelled, median lifetime 39.1 min, no success since `03:58:07Z`, validation failures 204 to 0 across `#2009`), and that the cause is not established. It first recorded a cause -- legacy single-language payloads colliding in the language-free group -- and that was withdrawn before this commit. The coordinator on current `main` builds one pending-language matrix and emits a single dispatch carrying all of it with no `required_language`, so the group needs no language term and current dispatches cannot collide with themselves. The candidate survives only for payloads queued before the cutover, which is what `#2009` exists to validate, and no cancelled run can be shown to carry one because a cancelled run serves no logs. A mass cancellation at `07:40:40Z` that crossed several concurrency groups in one second argues against it outright. The paragraph now states the measurements and leaves the mechanism open. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Sep 7, 2026
This was referenced Sep 8, 2026
seonghobae
added a commit
that referenced
this pull request
Sep 8, 2026
The completed-scan fallback matched only repo#PR@head plus language, so a same-head retarget could consume a predecessor-base scan and a different waiting required run could satisfy this shard. Encode live base SHA and required_run_id in the public dispatch run-name, look up that identity from the required shard, and POST the live base on later attempts. Concurrency stays repository+PR per #2008/#2009.
1 task
seonghobae
added a commit
that referenced
this pull request
Sep 8, 2026
* fix(codeql): keep a clean dispatch scan when status publish 403s opencode-agent is installed with statuses:read, so POST /statuses to a target repo returns HTTP 403 after the SARIF gate already passed. Treat the completed dispatch scan job as terminal evidence and let the required shard consume that public run on rerun instead of fail-closing a clean scan. * fix(codeql): dispatch remaining languages on workflow reruns Attempt 2 of .github#2028 skipped Dispatch current-head because the coordinator required github.run_attempt == 1, so no codeql-scan was posted. Later attempts still skip when every language already has a terminal opencode-agent verdict. * test(codeql): require paginated dispatch evidence lookup * test(codeql): require paginated dispatch job lookup * fix(codeql): paginate exact dispatch evidence * test(codeql): parse paginated gh endpoint options * style(codeql): normalize pagination fixture spacing * test(codeql): match paginated empty dispatch fixtures Signed-off-by: Seongho Bae <me@seonghobae.me> * fix(codeql): bind dispatch fallback to live base and required run The completed-scan fallback matched only repo#PR@head plus language, so a same-head retarget could consume a predecessor-base scan and a different waiting required run could satisfy this shard. Encode live base SHA and required_run_id in the public dispatch run-name, look up that identity from the required shard, and POST the live base on later attempts. Concurrency stays repository+PR per #2008/#2009. --------- Signed-off-by: Seongho Bae <me@seonghobae.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
#2008 squash-merged
required_jobsas the only wake-identity contract oncodeql-scan-dispatch.yml.repository_dispatchalways runs the default-branch file, so every payload that lined up before that merge still carries the old scalars (required_job_id+required_language) and a one-shard matrix. Those runs now fail closed at validate, and the required CodeQL job they were meant to wake stays failed in the pending handoff.This is the cutover hole, not a product change. The new one-dispatch-per-PR payload stays the preferred path.
What
required_jobsis a 1:1 map of language to canonical job id, matrix length >= 1, unique languages.required_jobsis empty (nullor[]) andrequired_language+required_job_idare present and the matrix length is 1 and the language matches, validate synthesizesrequired_jobs=[{language, job_id}]and accepts.required_jobsarray ignores leftover scalar fields, even when they conflict.{workflow}-{repository}-{PR}with no language suffix.Tests
116 passed.
Chicken-and-egg: this is not a product PR. It is a structural workflow repair so queued pre-#2008 dispatches can validate on the default-branch handler. If the 60-job ceiling keeps this repository's own required checks from starting, admin bypass squash merge is the documented recovery for this class of change.
Developer experience: a queued single-language
codeql-scandispatch validates instead of failing closed after the cutover; a current multi-languagerequired_jobspayload is unchanged.User experience: required CodeQL compatibility checks for those in-flight pull requests can still complete instead of remaining failed because the handler rejected a payload shape it used to accept.