Compliance: codeql-default-setup-not-configured #168

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   on Apr 9, 2026
2. don-petry commented on Apr 9, 2026

   

   don-petry

   on Apr 9, 2026

   CollaboratorAuthor

   More actions

   Weekly Compliance Audit (2026-04-09)

   This finding is still open.

   Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh google-app-scripts or gh api -X PATCH repos/petry-projects/google-app-scripts/code-scanning/default-setup -F state=configured -F query_suite=default.

   Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
3. don-petry

   added

   claude

   on Apr 9, 2026
4. don-petry commented on Apr 9, 2026

   

   don-petry

   on Apr 9, 2026

   Last edited by don-petry

   CollaboratorAuthor

   More actions

   Claude encountered an error —— View job

   ---

   I'll analyze this and get back to you.
5. don-petry commented on Apr 10, 2026

   

   don-petry

   on Apr 10, 2026

   CollaboratorAuthor

   More actions

   Weekly Compliance Audit (2026-04-10)

   This finding is still open.

   Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh google-app-scripts or gh api -X PATCH repos/petry-projects/google-app-scripts/code-scanning/default-setup -F state=configured -F query_suite=default.

   Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
6. don-petry

   added

   claude

   and removed

   claude

   on Apr 14, 2026
7. don-petry commented on Apr 14, 2026

   

   don-petry

   on Apr 14, 2026

   Last edited by don-petry

   CollaboratorAuthor

   More actions

   Claude finished @don-petry's task in 1m 55s —— View job • claude/issue-168-20260414-1135 • Create PR ➔

   ---

   Fixing CodeQL Default Setup

   • Gather context (read existing codeql.yml, fetch org template and standards)
   • Understand the required fix — standard requires GitHub-managed default setup; per-repo codeql.yml is drift
   • Enable GitHub CodeQL default setup via API (state=configured, query_suite=default)
   • Delete drift .github/workflows/codeql.yml file
   • Commit and push changes
   • Create PR — petry-projects/google-app-scripts#187
   • Tagged @don-petry (CODEOWNER) for review

   What was done

   1. Enabled GitHub-managed CodeQL default setup via gh api -X PATCH — the API returned a run ID confirming success.
   2. Removed .github/workflows/codeql.yml — per ci-standards §2, a per-repo codeql.yml is now drift (the two configurations are mutually exclusive and leaving the file causes double CI billing).
8. don-petry

   added a commit that references this issue on Apr 14, 2026

   ci: remove drift codeql.yml and enable GitHub-managed default setup

   ...

   This issue will close once commit e42e6bc is merged into the 'main' branch.

   e42e6bc
9. don-petry commented on Apr 17, 2026

   

   don-petry

   on Apr 17, 2026

   CollaboratorAuthor

   More actions

   Weekly Compliance Audit (2026-04-17)

   This finding is still open.

   Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh google-app-scripts or gh api -X PATCH repos/petry-projects/google-app-scripts/code-scanning/default-setup -F state=configured -F query_suite=default.

   Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
10. don-petry

    added

    claude

    and removed

    claude

    on Apr 18, 2026
11. don-petry commented on Apr 18, 2026

    

    don-petry

    on Apr 18, 2026

    Last edited by don-petry

    CollaboratorAuthor

    More actions

    Claude finished @don-petry's task in 3m 54s —— View job • claude/issue-168-20260418-1849 • [Create PR ➔](https://github.com/petry-projects/google-app-scripts/compare/main...claude/issue-168-20260418-1849?quick_pull=1&title=Issue%20%23168%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23168%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    ---

    Fixing CodeQL Compliance (Issue #168)

    • Gather context (check current repo state, fetch CI standards)
    • Understand the required fix
    • Enable GitHub-managed CodeQL default setup via API — succeeded (run_id returned, new scan triggered)
    • Delete drift .github/workflows/codeql.yml (per ci-standards §2)
    • Commit and push changes
    • Create PR — petry-projects/google-app-scripts#201
    • Self-review — only change is the deletion of codeql.yml (42 lines, nothing added); correct per standard
    • Tagged @don-petry (CODEOWNER) for review

    What was done

    1. Enabled GitHub-managed CodeQL default setup via gh api -X PATCH with state=configured and query_suite=default — API confirmed success with a run_id.
    2. Removed .github/workflows/codeql.yml — per ci-standards §2, this file is drift. GitHub-managed default setup and a per-repo workflow are mutually exclusive; keeping both causes double CI billing.

    Note on the 403 errors

    The weekly compliance audit reports 403 when reading the CodeQL default setup state. This is a token-scope issue in the audit runner (the endpoint requires security_events or Administration: write to read), not a repo configuration problem. The setup itself is configured — a direct API call confirms {"state":"configured"}. Once the audit token is updated with the correct scope, the finding should auto-close. This needs to be addressed in petry-projects/.github.

    Note: PR #187 (previous attempt) is still open and covers the same change — @don-petry may want to close it.
    • claude/issue-168-20260418-1849
12. don-petry

    added a commit that references this issue on Apr 18, 2026

    ci: remove drift codeql.yml and enable GitHub-managed default setup

    ...

    This issue will close once commit f48c178 is merged into the 'main' branch.

    f48c178
13. don-petry

    removed

    claude

    on Apr 19, 2026
14. 6 remaining items

    Load more

15. don-petry commented on May 8, 2026

    

    don-petry

    on May 8, 2026

    CollaboratorAuthor

    More actions

    Weekly Compliance Audit (2026-05-08)

    This finding is still open.

    Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh google-app-scripts or gh api -X PATCH repos/petry-projects/google-app-scripts/code-scanning/default-setup -F state=configured -F query_suite=default.

    Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
16. don-petry commented on May 11, 2026

    

    don-petry

    on May 11, 2026

    CollaboratorAuthor

    More actions

    Weekly Compliance Audit (2026-05-11)

    This finding is still open.

    Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh google-app-scripts or gh api -X PATCH repos/petry-projects/google-app-scripts/code-scanning/default-setup -F state=configured -F query_suite=default.

    Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
17. don-petry commented on May 12, 2026

    

    don-petry

    on May 12, 2026

    CollaboratorAuthor

    More actions

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: CodeQL default setup is in state {"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"}{"message":"Resource not accessible by personal access token","documentation_url":"https://docs.github.com/rest/code-scanning/code-scanning#get-a-code-scanning-default-setup-configuration","status":"403"} (expected configured). Run apply-repo-settings.sh google-app-scripts or gh api -X PATCH repos/petry-projects/google-app-scripts/code-scanning/default-setup -F state=configured -F query_suite=default.

    Standard: standards/ci-standards.md#2-codeql-analysis-github-managed-default-setup
18. don-petry commented on May 12, 2026

    

    don-petry

    on May 12, 2026

    CollaboratorAuthor

    More actions

    Resolved! This check is now passing as of 2026-05-12. Closing automatically.
19. don-petry

    closed this as completedon May 12, 2026
20. don-petry

    added a commit that references this issue on May 13, 2026

    ci: remove drift codeql.yml and enable GitHub-managed default setup

    ...

    This issue will close once commit eeb2bfe is merged into the 'main' branch.

    eeb2bfe
21. don-petry

    added a commit that references this issue on May 21, 2026

    ci: remove drift codeql.yml and enable GitHub-managed default setup (#…

    ...

    This issue will close once commit 1f31eeb is merged into the 'main' branch.

    1f31eeb
22. don-petry

    added 8 commits that reference this issue on Aug 2, 2026

    ci: remove drift codeql.yml and enable GitHub-managed default setup (#…

    ...

    This issue will close once commit 42fe805 is merged into the 'main' branch.

    42fe805

    feat: implement issue #442 — SonarCloud modernization (1/3): src/ app…

    ...

    This issue will close once commit e44d9ef is merged into the 'main' branch.

    e44d9ef

    ci: remove drift codeql.yml and enable GitHub-managed default setup (#…

    ...

    This issue will close once commit 0eb69f8 is merged into the 'main' branch.

    0eb69f8

    feat: implement issue #442 — SonarCloud modernization (1/3): src/ app…

    ...

    This issue will close once commit e773e0b is merged into the 'main' branch.

    e773e0b

    ci: remove drift codeql.yml and enable GitHub-managed default setup (#…

    ...

    This issue will close once commit 98d4e79 is merged into the 'main' branch.

    98d4e79

    feat: implement issue #442 — SonarCloud modernization (1/3): src/ app…

    ...

    This issue will close once commit 92ec7a3 is merged into the 'main' branch.

    92ec7a3

    ci: remove drift codeql.yml and enable GitHub-managed default setup (#…

    ...

    This issue will close once commit d5ec389 is merged into the 'main' branch.

    d5ec389

    feat: implement issue #521 — Compliance: stub-surface-drift-pr-auto-r…

    ...

    This issue will close once commit ce44c5f is merged into the 'main' branch.

    ce44c5f