From 7a32024de37861e4568ebb0f73f7d0666e4e0f55 Mon Sep 17 00:00:00 2001 From: geekypunk Date: Fri, 14 Aug 2026 17:59:31 -0500 Subject: [PATCH] fix(ci): drop the CodeQL visibility guard that blocked every merge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `if: github.event.repository.visibility == 'public'` sat on a matrix job. A job-level `if:` is evaluated before the matrix expands, so every skipped run reported one check under the raw template name, `analyze (${{ matrix.language }})`, instead of `analyze (java-kotlin)` and `analyze (javascript-typescript)`. While the repository was private that phantom name was the only CodeQL check anyone had seen, so it was pinned as a required status check in the `Protect main branch` ruleset. When the repository went public the job began running for real and reporting the two expanded names, leaving the required phantom with nothing to report it. Every pull request then stalled on "Expected — waiting for status to be reported": unmergeable, and with no failing job to point at, indistinguishable from CI being stuck. The guard has served its purpose — the repository is public and code scanning is free, which is the condition its own comment named for deleting it. The replacement comment records the failure mode so the `if:` is not reintroduced, and says to fix a future private repository in the ruleset instead. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/codeql.yml | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d40545e..400fb4e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,13 +18,19 @@ jobs: analyze: name: analyze (${{ matrix.language }}) runs-on: ubuntu-latest - # Code scanning is free on public repositories; on a private one it requires - # GitHub Advanced Security, which this organisation's free plan does not - # include. Without this guard every run fails with a 403 until the repository - # is public, and a permanently red workflow trains people to stop reading CI. - # DELETE THIS LINE once the repository is public — from then on a failure - # here is a real finding rather than a billing state. - if: github.event.repository.visibility == 'public' + # No visibility guard here, deliberately. A job-level `if:` is evaluated + # before the matrix expands, so a skipped run reports a single check under + # the raw template name — `analyze (${{ matrix.language }})` — rather than + # the two expanded names. That phantom name reached the `Protect main branch` + # ruleset as a required check (GitHub's suggestion list offers whatever was + # last reported), and once this repository went public and the job began + # reporting the real names instead, nothing was left to satisfy the phantom: + # every pull request stalled on "Expected — waiting for status to be + # reported", unmergeable, with no failing job to point at. + # + # Code scanning is free while this repository is public. If it ever goes + # private without GitHub Advanced Security, drop these contexts from the + # ruleset — do not reintroduce an `if:` here. permissions: # Required to upload results to the code-scanning API. security-events: write