chore(deps): bump com.github.kagkarlsson:db-scheduler-spring-boot-4-starter from 16.7.0 to 16.12.0 in /backend - #36
Open
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
4 tasks
venkateshsakamuri-lab
pushed a commit
that referenced
this pull request
Aug 15, 2026
## Problem
Pull requests were sitting on a required check that could never arrive:
```
analyze (${{ matrix.language }}) Expected — Waiting for status to be reported [Required]
```
Note the name: the **raw, un-interpolated template**. That is not a
check that failed — it is a check nothing will ever report.
## Root cause
`codeql.yml` guarded the `analyze` job with:
```yaml
if: github.event.repository.visibility == 'public'
```
A job-level `if:` is evaluated **before the matrix expands**. So when
the job is skipped, GitHub emits a *single* check run under the literal
`name:` template rather than the two expanded names. While this
repository was private, every PR reported exactly one CodeQL check,
named `analyze (${{ matrix.language }})`, conclusion `skipped` — still
visible on the older open PRs (#40, #36).
That phantom name was the only CodeQL check anyone had seen, so it was
pinned as a required status check in the `Protect main branch` ruleset —
GitHub's suggestion list offers whatever was last reported.
When the repository went public, the job started running for real and
reporting `analyze (java-kotlin)` and `analyze (javascript-typescript)`.
The required phantom was left with nothing to satisfy it, and every PR
became unmergeable with no failing job to point at.
## Fix
Remove the guard. Its own comment named the condition for deleting it —
*"DELETE THIS LINE once the repository is public"* — and that condition
is now met: the repository is public and code scanning is free.
The replacement comment records the failure mode so the `if:` is not
reintroduced, and directs a future private-repository scenario to the
ruleset instead of a job condition.
## Test plan
- [ ] CodeQL runs on this PR and reports **`analyze (java-kotlin)`** and
**`analyze (javascript-typescript)`** — not the template name
- [ ] Both legs pass, satisfying the two required contexts already
configured in the ruleset
- [ ] No new `if:` remains on the job (the two matches in the file are
inside comments)
- [ ] Watch the Monday `27 4 * * 1` cron: scheduled runs on Aug 3 and
Aug 10 both reported `skipped`, correctly, since the repository was
private then. Whether `github.event.repository.visibility` is even
populated on `schedule` events was never tested — removing the guard
makes it moot, and the next cron should now produce a real scan.
## Notes
- The `Protect main branch` ruleset has already been corrected
separately; it now lists only the two expanded contexts. This PR removes
the thing that generated the bad name in the first place.
- Older PRs created while the repository was private still carry the
stale skipped check and report `UNKNOWN` mergeability. A rebase or any
push forces GitHub to recompute them against the corrected ruleset.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…tarter Bumps [com.github.kagkarlsson:db-scheduler-spring-boot-4-starter](https://github.com/kagkarlsson/db-scheduler) from 16.7.0 to 16.12.0. - [Release notes](https://github.com/kagkarlsson/db-scheduler/releases) - [Commits](kagkarlsson/db-scheduler@v16.7.0...v16.12.0) --- updated-dependencies: - dependency-name: com.github.kagkarlsson:db-scheduler-spring-boot-4-starter dependency-version: 16.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/maven/backend/com.github.kagkarlsson-db-scheduler-spring-boot-4-starter-16.12.0
branch
from
August 15, 2026 17:53
5d93c7c to
c8ed52e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps com.github.kagkarlsson:db-scheduler-spring-boot-4-starter from 16.7.0 to 16.12.0.
Release notes
Sourced from com.github.kagkarlsson:db-scheduler-spring-boot-4-starter's releases.
... (truncated)
Commits
a02d60dbuild(deps-dev): bump org.xerial:sqlite-jdbc from 3.25.2 to 3.41.2.2 in /db-s...d29c497feat: add per-task summary to SchedulerClient (#874)277f96bfeat: sqlite support is added (#869)f520342build(deps): bump io.zonky.test.postgres:embedded-postgres-binaries-bom from ...9ff943afix: single statement lock-and-fetch unresolved task from first batch… (#811)8c3e465build(deps): bump org.mockito:mockito-bom from 5.20.0 to 5.23.0 (#866)7cc6edcbuild(deps): bump org.junit:junit-bom from 6.0.3 to 6.1.0 (#867)9481948refactor: mdc logging interceptor is refactored in spring boot example (#854)ef0d41efeat: add MaxRetriesBuilder fluent API for FailureHandler (#856)22c1fb9build(deps): bump org.jetbrains:annotations from 26.0.2 to 26.1.0 (#861)