fix(ci): drop the CodeQL visibility guard that blocked every merge - #56
Merged
Merged
Conversation
`if: github.event.repository.visibility == 'public'` sat on a matrix job. A
job-level `if:` is evaluated before the matrix expands, so every skipped run
reported one check under the raw template name, `analyze (${{ matrix.language
}})`, instead of `analyze (java-kotlin)` and `analyze (javascript-typescript)`.
While the repository was private that phantom name was the only CodeQL check
anyone had seen, so it was pinned as a required status check in the `Protect
main branch` ruleset. When the repository went public the job began running for
real and reporting the two expanded names, leaving the required phantom with
nothing to report it. Every pull request then stalled on "Expected — waiting
for status to be reported": unmergeable, and with no failing job to point at,
indistinguishable from CI being stuck.
The guard has served its purpose — the repository is public and code scanning
is free, which is the condition its own comment named for deleting it. The
replacement comment records the failure mode so the `if:` is not reintroduced,
and says to fix a future private repository in the ruleset instead.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
I think I have already disabled this from git project settings |
venkateshsakamuri-lab
approved these changes
Aug 15, 2026
geekypunk
pushed a commit
that referenced
this pull request
Aug 15, 2026
<!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary Prepares and documents the **v1.1.0** product cut from `main` since `v1.0.0`, and locks in a **weekly release cadence: Saturday 09:00 America/Los_Angeles**. ### Since v1.0.0 - Progressive dashboards (#57), dashboard improvements (#51) - Multi-schema UI (#55), Performance hub (#52) - CI CodeQL unblock (#56), cloud env caveats (#53) ### This PR - Bump `backend/pom.xml` → `1.1.0` - `CHANGELOG.md` + `docs/releases/RELEASE_NOTES-v1.1.0.md` - Cadence in `docs/oss-ux/RELEASE.md` - New `docs/oss-ux/WEEKLY_RELEASE_AUTOMATION.md` (cron + paste-ready prompt) - Daily triage doc clarified as optional (not the release cut) ### After merge 1. Tag `v1.1.0` on the merge commit and push → `.github/workflows/release.yml` publishes the GitHub Release. 2. Create the Cursor Automation once from `WEEKLY_RELEASE_AUTOMATION.md` (cannot be created via API). ### Pre-flight `scripts/self-host/e2e-agent-check.py` → `AGENT_OK True`, `DASH_OK True` on the current stack before this bump. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-8ce91e70-c67b-48c6-84b3-05bb9d06231a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-8ce91e70-c67b-48c6-84b3-05bb9d06231a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"><source](https://cursor.com/assets/images/open-in-cursor-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-cursor-light.png"><img](https://cursor.com/assets/images/open-in-cursor-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div](https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Pull requests were sitting on a required check that could never arrive:
Note the name: the raw, un-interpolated template. That is not a check that failed — it is a check nothing will ever report.
Root cause
codeql.ymlguarded theanalyzejob with:A job-level
if:is evaluated before the matrix expands. So when the job is skipped, GitHub emits a single check run under the literalname:template rather than the two expanded names. While this repository was private, every PR reported exactly one CodeQL check, namedanalyze (${{ matrix.language }}), conclusionskipped— still visible on the older open PRs (#40, #36).That phantom name was the only CodeQL check anyone had seen, so it was pinned as a required status check in the
Protect main branchruleset — GitHub's suggestion list offers whatever was last reported.When the repository went public, the job started running for real and reporting
analyze (java-kotlin)andanalyze (javascript-typescript). The required phantom was left with nothing to satisfy it, and every PR became unmergeable with no failing job to point at.Fix
Remove the guard. Its own comment named the condition for deleting it — "DELETE THIS LINE once the repository is public" — and that condition is now met: the repository is public and code scanning is free.
The replacement comment records the failure mode so the
if:is not reintroduced, and directs a future private-repository scenario to the ruleset instead of a job condition.Test plan
analyze (java-kotlin)andanalyze (javascript-typescript)— not the template nameif:remains on the job (the two matches in the file are inside comments)27 4 * * 1cron: scheduled runs on Aug 3 and Aug 10 both reportedskipped, correctly, since the repository was private then. Whethergithub.event.repository.visibilityis even populated onscheduleevents was never tested — removing the guard makes it moot, and the next cron should now produce a real scan.Notes
Protect main branchruleset has already been corrected separately; it now lists only the two expanded contexts. This PR removes the thing that generated the bad name in the first place.UNKNOWNmergeability. A rebase or any push forces GitHub to recompute them against the corrected ruleset.🤖 Generated with Claude Code