fix(ci): repoint codeql-action at a SHA that exists - #38
Merged
Conversation
github/codeql-action@29b1f65 is pinned here but exists in no repository -- the GitHub API returns 422 for it. CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all. Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API. Found while auditing the estate: the same non-existent SHA is pinned in over 100 repositories, so CodeQL is dead across nearly all of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. CI failed: CI workflow validation failed due to a retired scorecard-enforcer.yml workflow file and an improper OSSF Scorecard SARIF upload configuration.OverviewThe CI run failed because the repository's staleness gate and workflow standards enforcement checks failed on configuration issues related to the OSSF Scorecard and retired workflow files. FailuresWorkflow Validation and Staleness Gate Failure (confidence: high)
Summary
Code Review ✅ Approved 2 resolved / 2 findingsUpdates CI workflows, removes duplicate governance files, and updates the guix package definition, but the guix.scm package is incorrectly labeled as squisher-corpus and contains a license header mismatch. ✅ 2 resolved✅ Bug: guix.scm mislabeled as squisher-corpus in the live-files repo
✅ Quality: License mismatch: SPDX header MPL-2.0 vs license field PMPL-1.0
Tip Comment OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
🔍 Hypatia Security ScanFindings: 11 issues detected
View findings[
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
"type": "shell_download_then_run",
"file": "/home/runner/work/live-files/live-files/setup.sh",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 33 day(s) old [STALE]",
"type": "CSA001",
"file": "push-email-notify.yml",
"action": "update",
"rule_module": "code_scanning_alerts",
"severity": "medium"
},
{
"reason": "Code scanning (Hypatia): hypatia/workflow_audit/secret_action_without_presence_gate -- Hypatia workflow_audit: secret_action_without_presence_gate -- 58 day(s) old [STALE]",
"type": "CSA001",
"file": "instant-sync.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code scanning (Hypatia): hypatia/workflow_audit/scorecard_publish_with_run_step -- Hypatia workflow_audit: scorecard_publish_with_run_step -- 58 day(s) old [STALE]",
"type": "CSA001",
"file": "scorecard-enforcer.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code-scanning alert hypatia/workflow_audit/missing_timeout_minutes (medium) at push-email-notify.yml is 33 days old (threshold: 30 days) -- overdue for remediation",
"type": "CSA003",
"file": "push-email-notify.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code-scanning alert hypatia/workflow_audit/secret_action_without_presence_gate (high) at instant-sync.yml is 58 days old (threshold: 7 days) -- overdue for remediation",
"type": "CSA003",
"file": "instant-sync.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
|
🔍 Hypatia Security ScanFindings: 11 issues detected
View findings[
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
"type": "shell_download_then_run",
"file": "/home/runner/work/live-files/live-files/setup.sh",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 33 day(s) old [STALE]",
"type": "CSA001",
"file": "push-email-notify.yml",
"action": "update",
"rule_module": "code_scanning_alerts",
"severity": "medium"
},
{
"reason": "Code scanning (Hypatia): hypatia/workflow_audit/secret_action_without_presence_gate -- Hypatia workflow_audit: secret_action_without_presence_gate -- 58 day(s) old [STALE]",
"type": "CSA001",
"file": "instant-sync.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code scanning (Hypatia): hypatia/workflow_audit/scorecard_publish_with_run_step -- Hypatia workflow_audit: scorecard_publish_with_run_step -- 58 day(s) old [STALE]",
"type": "CSA001",
"file": "scorecard-enforcer.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code-scanning alert hypatia/workflow_audit/missing_timeout_minutes (medium) at push-email-notify.yml is 33 days old (threshold: 30 days) -- overdue for remediation",
"type": "CSA003",
"file": "push-email-notify.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
},
{
"reason": "Code-scanning alert hypatia/workflow_audit/secret_action_without_presence_gate (high) at instant-sync.yml is 58 days old (threshold: 7 days) -- overdue for remediation",
"type": "CSA003",
"file": "instant-sync.yml",
"action": "escalate",
"rule_module": "code_scanning_alerts",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github/codeql-action@29b1f65c1f735799893313399435a59f54045865is pinned here but exists in no repository — the GitHub API returns 422 for it.CodeQL therefore could not start: the run graph fails to build and the job reports
startup_failure, so this repository has had no CodeQL scanning at all.Repointed at
4187e74d05793876e9989daffde9c3e66b4acd07, which is what thev3tag currently resolves to (v3.37.3), verified against the API.Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.
Summary by Gitar
codeql-actionto a valid SHA4187e74dand added newcodeql.ymlworkflowactions: readpermissions across multiple workflow files for estate-wide security complianceguix.scmpackage definition fromlive-filestosquisher-corpusGOVERNANCE.adocfile in favor ofGOVERNANCE.mdThis will update automatically on new commits.