Repository navigation
[Governance] Reconcile GitHub-managed dynamic CodeQL contexts with central compatibility gates #1172
Description
Activity
- changed the title
[-]develop protection requires Analyze (javascript-typescript) / Analyze (python) but #1165 removed codeql.yml and default setup is off -- PRs cannot merge[/-][+]develop protection still requires retired CodeQL contexts after #1165; central CodeQL reports different names[/+]on Sep 6, 2026 Fresh 2026-09-06 consumer sweep reconfirms the configuration defect on unchanged protected authority.
developis still protected at314ddeae7b775a4957594b599358c8255617eb2eand still requires exactly 14 contexts, including retiredAnalyze (javascript-typescript)andAnalyze (python). No repository-local duplicate CodeQL PR scanner has been restored. Current open Draft owner heads are therefore kept non-ready; this stale protection contract is not being bypassed or treated as an Actions-queue failure. The accepted repair remains exact branch-protection migration toCodeQL compatibility analysis (javascript-typescript)andCodeQL compatibility analysis (python), followed by unchanged-head terminal evidence. The available GitHub application connection exposes branch-protection reads but no administration mutation, so this run can attach exact consumer evidence but cannot safely mutate the protected-context list itself.Escalating: this repository is frozen, and unlike the sibling cases there is no bypass available.
Re-measured today, 2026-09-06.
enforce_adminsistrueherebranches/develop/protection enforce_admins true strict true required 14 contexts, of which Analyze (javascript-typescript) <- nothing produces this Analyze (python) <- nothing produces this CodeQL default setup not-configuredThe other two repositories with this class of defect (
.github,contextual-orchestrator) both haveenforce_admins = false, and merges have continued there by bypassing protection. That route does not exist in this repository. Protection here is being enforced exactly as configured, against a requirement that cannot be satisfied.The breaking commit was the last one through
Last merge into
develop:314ddeae 2026-09-04T09:48:51Z ci: consolidate repository workflow backstops (#1165)That is #1165 — the commit that removed
codeql.yml. Nothing has merged since. It sealed the door behind itself, and the repository has been closed for roughly two days against ~196 open pull requests.Verified at a live head
#1139 at
0cab3700: 12 of the 14 required contexts are present and passing; the twoAnalyze (…)contexts are absent — not failing, absent.mergeable_state = blocked, with no failing check to point at.One correction to something I said elsewhere
I have been reporting a separate finding that
strict = truemakes protection unsatisfiable while a default branch moves quickly. That does not apply here, and the difference matters for this issue:developis not moving at all (0 merges in 24h), so a branch here can be green and up to date at the same time. Restoring the two contexts — or removing them from protection — is sufficient to unblock this repository. No deeper change is needed, unlike in.githubwhere the merge rate is the binding constraint.That makes this the cheapest of the three fixes and the one with the largest immediate effect.
Unchanged from the original report: which direction to take (enable CodeQL default setup so the
Analyze (…)contexts are produced again, or drop them because CodeQL now runs centrally under different names) is a policy call, and branch protection is an authorization boundary, so I have not changed it.Closing the remaining objection: no workflow in this repository can produce those two contexts.
The natural challenge to the report above is that some other workflow might declare a job reporting
Analyze (javascript-typescript)/Analyze (python), making the absence incidental rather than structural. It cannot.Parsing every workflow on
developwith a YAML parser — jobname:where present, job id otherwise, which is exactly how GitHub derives a check-run name:workflows on develop build-baseline.yml ci.yml ossf-scorecard.yml release.yml sbom.yml security-audit.yml codeql.yml absent (404) jobs whose effective check-run name mentions "analyze" or "codeql": 0So the two required contexts have no producer of any kind: the workflow that used to report them was deleted by #1165, no surviving workflow declares a replacement, and CodeQL default setup — the other mechanism that emits
Analyze (…)checks — isnot-configured.Re-confirmed at the same time, unchanged:
enforce_admins = true,strict = true, 196 open pull requests, anddevelopstill at314ddeaefrom 2026-09-04.One consequence worth stating explicitly, because it is easy to assume otherwise: the central dispatch-identity defect tracked in ContextualWisdomLab/.github#1929 is a real problem, but fixing it will not unblock this repository. That dispatch produces contexts named
CodeQL compatibility analysis (…). Protection here requiresAnalyze (…), which is CodeQL default setup's naming convention. Different names, different producer. This repository needs its own protection list corrected, or default setup enabled — nothing upstream substitutes for that.I checked this with a parser rather than a text search after getting a related audit wrong earlier today by matching strings instead of parsing YAML.
- changed the title
[-]develop protection still requires retired CodeQL contexts after #1165; central CodeQL reports different names[/-][+][Governance] Reconcile GitHub-managed dynamic CodeQL contexts with central compatibility gates[/+]on Sep 12, 2026 Fresh exact-head reconciliation receipt from #866
7156aebd4a745cab4842d15aba319a72c80e1d98confirms the two CodeQL layers are still distinct.On this same exact PR head, GitHub-managed dynamic required contexts are terminal GREEN:
Analyze (javascript-typescript)check106684070762: SUCCESS;Analyze (python)check106684070975: SUCCESS.
Separately, organization
CodeQL PRrun35708793972is terminal FAILURE. Its compatibility language jobs read the current-head delegated verdict successfully but seependingand fail enforcement; a later coordinator job106855384749dispatches successfully without re-settling the already-failed receivers. The exact consumer receipt is routed to canonical central lifecycle ownerContextualWisdomLab/.github#1929.Therefore this head strengthens the current #1172 premise: classic
Analyze (...)contexts are satisfiable and GREEN via the dynamic GitHub producer, while the central compatibility/settlement layer remains independently unhealthy. Do not describe the classic contexts as retired or remove/replace them merely to mask the separate central defect.
Fresh live correction — 2026-09-12
The original premise of this issue is no longer true on a current BandScope PR head.
Protected
developremains314ddeae7b775a4957594b599358c8255617eb2e, and the repository tree still contains no repository-ownedcodeql.yml. However canonical Resource Admission #866 exact head0cb51e4d042a8f4cd5742086156a307bfe1ffac6now receives both classic checks successfully:Analyze (javascript-typescript)— check run103480532592, terminal SUCCESS;Analyze (python)— check run103480532766, terminal SUCCESS.Both checks belong to Actions run
34666902068, whose workflow path isdynamic/github-code-quality/codeqland whose display name isCode Quality: PR #866. The producer is therefore GitHub-managed/dynamic rather than a restored repository workflow. The protecteddevelopworkflow tree still consists ofbuild-baseline.yml,ci.yml,ossf-scorecard.yml,release.yml,sbom.yml, andsecurity-audit.yml; no local CodeQL PR workflow has reappeared.This directly supersedes the 2026-09-06/07 evidence in earlier comments that the classic
Analyze (...)contexts had “no producer of any kind” and were structurally unsatisfiable. That evidence was valid for those heads at that time, but it must not be used as current authority.Separate central compatibility defect remains
The organization-required
CodeQL PRworkflow is still a separate path. On the same #866 exact head, run34666905716has failingCodeQL compatibility analysis (...)language jobs whileDispatch current-head CodeQL scansucceeds. That producer/settlement defect remains owned by the canonical central.githubrecovery path; BandScope must not add a copied scanner, synthetic status, pass-through success job, or gate weakening to hide it.The important correction is that classic
Analyze (...)is currently satisfiable and GREEN via GitHub-managed dynamic CodeQL. Therefore migrating branch protection away from those names is no longer justified merely because repositorycodeql.ymlwas removed.#1183 disposition
Draft #1183 currently changes
docs/security/github-required-checks.mdfromAnalyze (...)toCodeQL compatibility analysis (...)based on the now-obsolete “retired/unsatisfiable” premise. Keep #1183 Draft as a preservation/rework lane; its current semantic diff must not become shipped truth unchanged.Do not close #1183 merely because its premise changed. Either adapt it after the control-plane owner decision below or replace it with a verified successor that fully preserves any still-valid documentation/governance delta.
Required control-plane decision and RCA
Before any branch-protection or documentation mutation:
dynamic/github-code-quality/codeqlis the intended durable GitHub-managed CodeQL authority for BandScope, including how it is enabled/configured and what lifecycle guarantees exist;CodeQL compatibility analysis (...)settlement path and determine whether it is intended as an additional organization evidence layer or an eventual replacement required context;Analyze (...)remains the required authority, update documentation to name that GitHub-managed dynamic owner and keep central compatibility evidence distinct rather than falsely describingAnalyze (...)as retired.Acceptance
docs/security/github-required-checks.mdmatches the actual enforcement model and owner boundary..githubsettlement is repaired without BandScope-local duplicate scanning or synthetic statuses.Keep this issue open until the live producer/protection/documentation contract is reconciled. The current evidence removes the former repository-freeze diagnosis; it does not by itself prove the central compatibility path healthy.