ci: remove drift codeql.yml and enable GitHub-managed default setup#201
ci: remove drift codeql.yml and enable GitHub-managed default setup#201don-petry wants to merge 3 commits into
Conversation
Per ci-standards §2, CodeQL must use GitHub-managed default setup, not
an inline workflow file. The per-repo codeql.yml is classified as drift
now that default setup is configured (state=configured, query_suite=default).
Enabled GitHub-managed default setup via:
gh api -X PATCH repos/petry-projects/google-app-scripts/code-scanning/default-setup \
-F state=configured -F query_suite=default
Closes #168
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 56 minutes and 13 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@don-petry — PR is ready for review. This removes the drift |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Removes the repository-scoped CodeQL workflow so the repo relies solely on GitHub-managed CodeQL default setup (to avoid “drift” and double-scanning).
Changes:
- Deleted
.github/workflows/codeql.ymlto eliminate per-repo CodeQL workflow configuration. - Leaves CodeQL configuration to GitHub-managed default setup (configured out-of-band via API, per PR description).
|
Summary
state=configured,query_suite=default).github/workflows/codeql.ymlworkflow file, which ci-standards §2 classifies as driftWhy
Per ci-standards §2, CodeQL must use GitHub-managed default setup, not an inline workflow file:
The API PATCH was applied successfully — GitHub confirmed
state=configuredwith a new run ID. Thecodeql.ymlfile is now removed to eliminate the drift finding and prevent double-scanning.Note on compliance audit 403 errors
The weekly compliance audit has been returning 403 when attempting to read the CodeQL default setup state via
GET /repos/.../code-scanning/default-setup. This is a token-scope issue in the audit runner (requiressecurity_eventsorAdministration: writeto read code-scanning settings), not a repo configuration problem. The GitHub-managed setup itself is configured — a direct API call confirms{"state":"configured"}. Once the audit token is updated with the correct scope, the finding should auto-close.Closes #168
Generated with Claude Code