fix(ci): drop beta-Rust CodeQL leg (cancelled/hanging 'checks 2 things forever')#21
Merged
Merged
Conversation
CodeQL Rust support is beta — that matrix leg cancels/hangs and never resolves (the recurring "CodeQL checks 2 things forever" symptom), giving zero real coverage. Removed it; ensured an actions leg remains so the matrix is non-empty (no zero-jobs startup_failure). Rust security belongs in cargo-audit/clippy. Verified with actionlint: no parse/syntax errors; actions leg present, no active rust leg. Part of the estate-wide CI cleanup (13 repos; reference hyperpolymath/gitbot-fleet#375). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 50 issues detected
View findings[
{
"reason": "Issue in scorecard.yml",
"type": "missing_workflow",
"file": "scorecard.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in ci.yml",
"type": "npermissions_typo",
"file": "ci.yml",
"action": "fix_typo",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in ci.yml",
"type": "missing_timeout_minutes",
"file": "ci.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "missing_timeout_minutes",
"file": "instant-sync.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
marked this pull request as ready for review
July 17, 2026 22:05
hyperpolymath
enabled auto-merge (squash)
July 17, 2026 22:06
hyperpolymath
disabled auto-merge
July 17, 2026 22:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The CodeQL matrix analysed a
rustleg. CodeQL Rust support is beta — that leg cancels/hangs and never resolves (the recurring "CodeQL checks 2 things forever" symptom), providing zero real security coverage.Fix
Remove the
rustleg; keep/ensure anactionsleg so the matrix stays non-empty (no zero-jobsstartup_failure). Rust security belongs in native tooling (cargo-audit / clippy), not beta CodeQL.Verification
actionlint: no parse/syntax errors; matrix has anactionsleg and zero activerustlegs.Context
Estate-wide shared-fate: 13 repos carried this beta-Rust CodeQL leg. Reference: hyperpolymath/gitbot-fleet#375.
🤖 Generated with Claude Code