Add github.code_scanning for CodeQL default setup - #122
Open
ppkarwasz wants to merge 7 commits into
Open
Conversation
Allow projects to self-service enable GitHub code scanning (CodeQL default setup) from .asf.yaml, as requested in apache#94: github: code_scanning: true or, for more control: github: code_scanning: query_suite: extended threat_model: remote languages: - java-kotlin The directive reads the current default setup configuration first and only issues a PATCH when the desired settings differ, avoiding redundant analysis runs. Removing the section disables the setup only if it was previously managed via .asf.yaml, following the semantics established in apache#121. Language identifiers are deliberately not validated client-side, as GitHub extends the CodeQL language set over time. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
potiuk
reviewed
Aug 13, 2026
An explicit `code_scanning: false` now returns early unless the setup was previously managed through `.asf.yaml`, matching the guard used by the sibling directives, so a default setup enabled by INFRA is left untouched. Document the disable semantics in the README. Assisted-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HG2YkEme3CUshbsNKK1GRH
Send query_suite in the PATCH payload only when the user set it, like threat_model and languages, and drop the strictyaml-injected "default" default so an omitted key truly leaves the suite unmanaged. This prevents .asf.yaml from silently downgrading a default setup that INFRA configured with the extended suite. Assisted-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HG2YkEme3CUshbsNKK1GRH
Accept any 2xx status for the default setup PATCH, matching the sibling directives, so an unexpected success code is not reported as an error (which would also skip writing the settings cache and repeat on every push). Guard the JSON parse of the GET response so a 200 with a non-JSON body produces a helpful message instead of a raw JSONDecodeError. Assisted-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HG2YkEme3CUshbsNKK1GRH
Removing a key from the code_scanning map keeps its last applied value on GitHub's side; document this and the disable/re-enable cycle as the way to return to automatic language selection. Verified against the live API on a scratch repository: omitted PATCH fields keep their previous values, "languages": [] means "no languages selected" rather than a reset to auto-detection, and a disable/re-enable cycle resets the whole configuration. Assisted-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HG2YkEme3CUshbsNKK1GRH
Assisted-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HG2YkEme3CUshbsNKK1GRH
Member
Author
|
@potiuk all five of your review comments are now addressed (each thread has a reply with the corresponding commit; the sticky-fields one includes results of testing the API semantics on a scratch repo). Could you take another look when you have a moment? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allows projects to self-service enable GitHub code scanning (CodeQL default setup) from
.asf.yaml, as requested in #94 (code scanning part only; secret scanning can be a follow-up):or, for more control:
Design notes:
enabledkey), matching howrulesetsworks; a plain boolean is accepted for the simple case./repos/{org}/{repo}/code-scanning/default-setupfirst and only PATCHes when the desired settings differ, so unrelated.asf.yamledits do not re-trigger analysis runs, and both 200 and 202 (async validation run) are treated as success..asf.yaml(sameprevious_yamlsemantics as Clear branch protection rules when protected_branches is removed #121); a setup enabled manually through the GitHub UI is left untouched.languagesvalues are deliberately not validated client-side, since GitHub extends the CodeQL language set over time; invalid values surface as a GitHub 422 relayed to the committer by email, as are the 403/409 cases (archived repo, setup change in progress, Actions disabled).github_copilot_code_review.pyfake-requester pattern; README documents the new section.Fixes #94
🤖 Generated with Claude Code