Conversation
…lt setup Per ci-standards.md §2, CodeQL should be configured via GitHub-managed default setup (Settings → Code security), not a per-repo workflow file. Per-repo codeql.yml files are treated as drift by the compliance audit. Enabled default setup via: gh api -X PATCH repos/petry-projects/TalkTerm/code-scanning/default-setup -F state=configured -F query_suite=default Closes #95 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 57 minutes and 43 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@don-petry — this PR is ready for review and merge. It fixes the CodeQL compliance finding by removing the drift |
There was a problem hiding this comment.
Pull request overview
Removes the repository-managed CodeQL workflow to align with org CI standards that require GitHub-managed CodeQL default setup (configured in repo settings rather than via workflow code).
Changes:
- Deleted
.github/workflows/codeql.yml(previous advanced CodeQL workflow). - Relies on GitHub’s Code Scanning default setup being configured (
state=configured,query_suite=default) outside the repo.
Comments suppressed due to low confidence (1)
.github/workflows/codeql.yml:1
- Deleting this workflow removes the CodeQL
actionslanguage scan (the workflow/pipeline security query pack). GitHub-managed CodeQL default setup typically scans only code languages (e.g., JS/TS) and does not include the GitHub Actions query suite; if Actions scanning is still desired, add a minimal dedicated workflow forlanguage: actions(or confirm the org standard explicitly accepts losing Actions scans).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Outdated review (superseded by re-review at
|
![petry-projects-pr-review-agent[bot]](https://avatars.githubusercontent.com/u/258516906?s=60&v=4){kind=small}
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 6a372436378de366f758f136a4c8f26fa577c8f7
Review mode: triage-approved (single reviewer)
Summary
Triage cleared this PR as low-risk and confirmation review agrees. The PR is now effectively a no-op: the target file .github/workflows/codeql.yml was already removed from main by PR #115 ("chore(ci): remove stray codeql.yml workflow"), so this PR's diff vs base is empty — additions=0, deletions=0, changedFiles=0. The head commit is just merge commits from main keeping the branch fresh. The substantive change was already approved in the prior cascade review at 71bec41 and the outcome (CodeQL via GitHub-managed default setup, no per-repo codeql.yml) is now the live state of main.
Linked issue analysis
Closes #95 ("CodeQL per-repo workflow is drift per org standard"). The remediation prescribed by petry-projects/.github ci-standards.md §2 — delete codeql.yml and rely on GitHub-managed default setup — is now realized on main (via #115). CodeQL default-setup analysis is empirically running on main: the head SHA shows successful Analyze (actions) and Analyze (python) checks under the managed setup. Issue is substantively addressed.
Findings
Info
- [info] (no-op-merge) —
gh api compare/main...HEADreturnsahead=10, behind=0, files=[]. All 10 commits ahead are merge commits frommain; no file diff remains. Merging this PR is a harmless fast-forward of trivial merge metadata. - [info] (already-realized) —
.github/workflows/codeql.ymlis absent from bothmainand the PR head, confirming PR #115 already delivered the file removal. Closing this PR (or merging it as a no-op) both produce the same end state. - [info] (coverage-preserved) — Successful
Analyze (actions)andAnalyze (python)CodeQL check runs at HEAD confirm GitHub-managed default setup is active and scanning both languages, matching the prior review's empirical verification at71bec41.
CI status
All required checks SUCCESS: CodeQL Analyze (actions), CodeQL Analyze (python), SonarCloud (0 new issues / 0 hotspots), AgentShield, Secret scan (gitleaks), Claude Code, Dependency audit (ecosystem detect; language-specific jobs skipped as expected). Dependabot auto-merge and a few language-specific audit jobs are SKIPPED as expected. reviewDecision=APPROVED, mergeable=MERGEABLE. mergeStateStatus=BLOCKED is residual from prior protection state; not caused by any failing check.
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 39980fc8f51658c71362335b8ac0b9a8fbacacb7
Review mode: triage-approved (single reviewer)
Summary
Triage cleared this PR as low-risk and confirmation review agrees. The PR is now a no-op merge: .github/workflows/codeql.yml was already removed from main by PR #115 ("chore(ci): remove stray codeql.yml workflow"), so this PR's diff vs base is empty — additions=0, deletions=0, changedFiles=0 across 12 merge commits ahead of main. The substantive change was approved in a prior cascade review at 71bec41 and is now the live state of main. The 4 new commits since the prior review at 6a372436 are unrelated merges from main bringing in PR #176's claude.yml → dev-lead.yml rename; none affect this PR's intent.
Linked issue analysis
Closes #95 ("CodeQL per-repo workflow is drift per org standard"). The remediation prescribed by petry-projects/.github ci-standards.md §2 — delete codeql.yml and rely on GitHub-managed default setup — is realized on main (via #115). CodeQL default-setup analysis is empirically running at HEAD: Analyze (actions) and Analyze (python) check runs both SUCCESS. Issue is substantively addressed.
Findings
Info
- [info] (no-op-merge) —
gh api compare/main...HEADreturnsahead=12, behind=0, files=[]. All 12 commits ahead are merge commits frommain; no file diff remains. Merging this PR is a harmless fast-forward of merge metadata; closing it produces the same end state. - [info] (already-realized) —
.github/workflows/codeql.ymlconfirmed absent frommain(GET contents/.github/workflows/codeql.yml?ref=main→ 404). PR #115 already delivered the file removal. - [info] (incremental-diff) — Changes since prior review
6a372436(4 commits, files=claude.yml,dev-lead.yml) are unrelated merge-ins from PR #176's dev-lead rollout, not edits to this PR's branch. - [info] (coverage-preserved) — Successful
Analyze (actions)andAnalyze (python)CodeQL check runs at HEAD confirm GitHub-managed default setup remains active and scanning both languages, matching the prior review's empirical verification.
CI status
All required checks SUCCESS: CodeQL Analyze (actions), CodeQL Analyze (python), CodeQL aggregate, CodeRabbit, SonarCloud (0 new issues / 0 hotspots). reviewDecision=APPROVED, mergeable=MERGEABLE. mergeStateStatus=BLOCKED is residual from prior protection state, not caused by any failing check.
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
Superseded by automated re-review at 39980fc.
|
@dev-lead - please fix this PR |
|
Automated review — human attention neededThis PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops. Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the Posted by the donpetry-bot PR-review cascade. |
|
Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead. |
Pull request was closed
Summary
state=configured,query_suite=default)codeql.ymlworkflow file, which is classified as drift by the org CI standardsWhy
Per
ci-standards.md §2, CodeQL must be configured through GitHub's default setup (Settings → Code security), not via a per-repo workflow file. The standard explicitly states: "per-repocodeql.ymlfiles are treated as drift by the compliance audit."The existing
codeql.ymlwas an advanced setup that duplicated what GitHub's managed default setup provides automatically, including auto-detected languages and managed analyzer versions.Changes
.github/workflows/codeql.yml(drift per org standard)gh api -X PATCH repos/petry-projects/TalkTerm/code-scanning/default-setup -F state=configured -F query_suite=defaultCloses #95
Generated with Claude Code