From 2715709224137d3b7d83efd28772a8d415bd2e81 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Wed, 26 Aug 2026 13:05:51 +0200 Subject: [PATCH] docs(merge-strategy): CodeQL default setup never analyzes fork PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Default setup's Analyze contexts, required in classic branch protection, never report on a fork PR head — the PR sits BLOCKED with every visible gate green, and neither the rules endpoint (classic protection is invisible there) nor the rollup (the contexts are absent, not red) names the cause. Documents the GraphQL isRequired diagnosis, the helper-branch workaround that shares the head SHA, and the durable fix of switching to an advanced-setup codeql.yml whose Analyze job matrix reproduces the required context names — including the disable-default-setup-first ordering, without which SARIF uploads are refused. Observed and fixed 2026-08-26 on netresearch/git-workflow-skill (#226, #237, #240). Assisted-by: claude-code:claude-fable-5 Agent-Session: https://claude.ai/code/session_01C7S9rbgu5giqCwnzwafrHA Agent-Host: 0493f0 Signed-off-by: Sebastian Mendel --- .../references/merge-strategy.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/skills/github-project/references/merge-strategy.md b/skills/github-project/references/merge-strategy.md index a8c84dc..131416a 100644 --- a/skills/github-project/references/merge-strategy.md +++ b/skills/github-project/references/merge-strategy.md @@ -270,6 +270,46 @@ see the section below on REST-vs-GraphQL); (2) touch a file of a configured lang analysis has an object; (3) wait — GitHub sometimes expires wedged queued check-runs after several hours, but neither timing nor outcome is dependable. +### CodeQL default setup never analyzes fork PRs — required `Analyze` contexts become unsatisfiable + +The sibling failure to the wedge above, structural instead of transient: +CodeQL **default setup** does not analyze pull requests from forks at all. +Where its contexts (`Analyze (actions)`, `Analyze (python)`, …) are **required** +in branch protection, every fork PR sits at `mergeStateStatus: BLOCKED` with +all visible gates green — the contexts simply never appear on the head commit. +Same-repo PRs merge fine, so the hole stays invisible until the first outside +contribution (observed 2026-08-26, netresearch/git-workflow-skill#226). + +Two things make the diagnosis slow if you do not know them: + +- The requirement usually hides in **classic branch protection** + (`repos/{r}/branches/{base}/protection`, admin-only), which the + `rules/branches/{base}` endpoint never shows — the ruleset view looks + permissive while the classic list names the Analyze contexts. +- The missing contexts leave **no trace in the rollup**. Diagnose with GraphQL + `statusCheckRollup { contexts { ... isRequired(pullRequestNumber: N) } }`: + the required-but-absent names are the ones not in the list at all. The head's + `github-advanced-security` check suite carrying only third-party SARIF + uploads (Sonar, zizmor, …) confirms default setup never ran. + +**Workaround to land the blocked fork PR:** push the identical head commit as +a base-repo branch and open a helper draft PR — default setup analyzes that +one and attaches its `Analyze` check runs to the SHA, which the fork PR shares, +so it unblocks. After the fork PR merges, GitHub marks the helper PR "merged" +by reachability and auto-deletes its branch; no separate cleanup. + +**Durable fix:** replace default setup with an advanced-setup `codeql.yml` +whose job is named `Analyze` with a language matrix — the check runs then carry +exactly the context names the protection already requires, so the required list +stays untouched. Order matters: **disable default setup first** +(`gh api -X PATCH repos/{r}/code-scanning/default-setup -f state=not-configured`) +— while it is enabled, GitHub refuses SARIF uploads from advanced +configurations and the new workflow's Analyze jobs fail. Mirror the old +config (`gh api repos/{r}/code-scanning/default-setup` shows languages, query +suite, schedule). As a workflow it runs on fork PRs like any other, subject to +the usual once-per-push run approval (fixed this way in +netresearch/git-workflow-skill#240). + ### `gh pr merge` falsely reports "base branch policy prohibits the merge" `gh pr merge` (GraphQL path) can fail with "the base branch policy prohibits the merge" even when every requirement is verifiably satisfied (rollup SUCCESS, signature valid, 0 required approvals, 0 unresolved threads, branch up to date, no blocking rulesets), and `--auto` never fires either. The REST endpoint succeeds immediately on the same head SHA: