test(ci): security-events to job-level only in codeql.yml (residual startup_failure probe) - #92
hyperpolymath wants to merge 1 commit into
Conversation
… startup_failure) All estate repos whose codeql passes keep security-events: write at JOB level only (hypatia, nexia-list, standards canonical). vexometer is the sole remaining startup_failure after the v4.38.1 rollback (#90), and its codeql.yml is the only one ALSO granting it at workflow top level. This is a measurement PR: if the pin rollback alone was insufficient, the top-level grant variant is now the only structural difference.
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (15)
📝 SummarySummary by CodeRabbit
WalkthroughThe CodeQL workflow removes the workflow-level ChangesCodeQL permissions
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The change narrows CodeQL permission scope while retaining access for the analysis job. No actionable merge-blocking risk is identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit reads each line, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Result: negative. Top-level |
2 participants
Diagnostic PR
vexometer remained
startup_failureon CodeQL after #90's v4.38.1→v4.38.0 rollback — the only repo in the estate where the proven fix didn't cure it. Its codeql.yml is also the only one in the estate that grantssecurity-events: writeat workflow top level (all passing repos keep it job-level only). This PR tests whether that grant shape is the residual blocker.