Repository navigation
fix(ci): align CodeQL extraction with the candidate workspace - #20
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first central CodeQL run failed its Actions lane because database init used candidate/ as source-root while analyze invoked extraction from GITHUB_WORKSPACE. JavaScript also indexed both the control/ and candidate/ checkouts. Align source-root, extractor working directory and SARIF checkout_path by checking out the candidate at the workspace root.
First check out the approved base controls, preserve only the standalone authority guard and SARIF checker in a canonical temporary directory outside the analysis tree, then cleanly check out the exact candidate at the root. Execute only those saved base-owned validators. Both CodeQL languages, explicit ref/SHA attribution, permissions, original verification and the fail-closed aggregate stay intact.
Validation: npm test passes (31 passed, one Linux-only filename test skipped on macOS); actionlint, syntax and diff checks pass. New executable regression coverage proves base-only files are removed, candidate source remains at the root, saved helpers remain outside it, candidate helper replacements never execute, temporary-directory aliases are resolved, and saved guards reject symlinks/findings. Independent read-only review found no concrete new bypass/regression.
Verification limit: this draft's pull_request_target execution uses the still-broken trusted base workflow, so it cannot exercise this corrected layout. Actual extractor inclusion/exclusion and SARIF path mapping must be verified separately before claiming the scanner is repaired; no privileged candidate-workflow bootstrap or check bypass is introduced.