Compliance: codeql-default-setup-not-configured #63

Activity

1. don-petry

   added

   claude

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   on May 8, 2026
2. don-petry commented on May 8, 2026

   

   don-petry

   on May 8, 2026

   Last edited by don-petry

   CollaboratorAuthor

   More actions

   Claude finished @don-petry's task in 1m 49s —— View job

   ---

   Analyzing compliance issue

   • Gather context (check for existing PRs, read CLAUDE.md, review standards)
   • Understand the CodeQL default setup requirement
   • Investigate current CodeQL status
   • Determine if implementation is needed

   Findings

   The repository is already compliant. CodeQL default setup is fully configured:

   {
     "state": "configured",
     "languages": ["actions", "javascript", "javascript-typescript", "python", "typescript"],
     "query_suite": "default",
     "updated_at": "2026-05-07T02:54:47Z",
     "schedule": "weekly"
   }

   The compliance check in this issue showed 403 errors because the PAT used by the compliance audit did not have permission to read the code scanning default setup configuration — it was unable to read the status, not an indication that CodeQL was unconfigured.

   Per the CI standards, CodeQL must be GitHub-managed default setup (not a codeql.yml workflow file). This repository:

   • ✅ Has CodeQL default setup in state: configured
   • ✅ Uses the default query suite
   • ✅ Has no codeql.yml workflow file (which would be drift/double-billing)
   • ✅ Auto-detected all relevant languages: actions, javascript, python, typescript

   No code changes are needed. This issue can be closed as the repository is already in compliance. The underlying cause was likely that the compliance audit's PAT lacked code-scanning:read permissions, causing it to misreport the status.
3. don-petry commented on May 11, 2026

   

   don-petry

   on May 11, 2026

   CollaboratorAuthor

   More actions

   Weekly Compliance Audit (2026-05-11)

   This finding is still open.

   Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh .github-private or gh api -X PATCH repos/petry-projects/.github-private/code-scanning/default-setup -F state=configured -F query_suite=default.

   Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
4. don-petry commented on May 12, 2026

   

   don-petry

   on May 12, 2026

   CollaboratorAuthor

   More actions

   Weekly Compliance Audit (2026-05-12)

   This finding is still open.

   Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh .github-private or gh api -X PATCH repos/petry-projects/.github-private/code-scanning/default-setup -F state=configured -F query_suite=default.

   Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
5. don-petry commented on May 12, 2026

   

   don-petry

   on May 12, 2026

   CollaboratorAuthor

   More actions

   Resolved! This check is now passing as of 2026-05-12. Closing automatically.
6. don-petry

   closed this as completedon May 12, 2026