CodeQL reports neutral on every PR: 3 configurations run on main but not on PR heads

[twistedmelonman]

Summary

CodeQL reports neutral on pull requests with the title "3 configurations not found". The three analyses run fine on main, but do not run on PR heads, so code scanning cannot diff the PR against the base and declines to report.

This is not a finding — nothing is flagged as vulnerable. It is code scanning declining to answer, which is a different thing and is easy to misread as a pass.

Observed

On #75 (a Dependabot npm_and_yarn group bump), head 1bf61fb:

CodeQL = neutral
title:   3 configurations not found
summary: Code scanning cannot determine the alerts introduced by this pull
         request, because 3 configurations present on refs/heads/main were
         not found:
           /language:actions
           /language:javascript-typescript
           /language:python

The full check-run list on that head contains no CodeQL analysis jobs at all — only the roll-up CodeQL check:

claude-review-haiku / run-review    = success
claude-review / run-review          = success
standards-check / run-standards-check = success
validate                            = success
dependabot-auto-merge / auto-merge  = success
CodeQL                              = neutral

Meanwhile the same three analyses do run on main. Most recent, via code-scanning/analyses:

Category	Last run
/language:javascript-typescript	2026-09-10T20:19:06Z
/language:python	2026-09-10T20:18:48Z
/language:actions	2026-09-10T20:18:37Z

Configuration

Default setup is enabled and configured for five languages:

{
  "state": "configured",
  "query_suite": "default",
  "languages": ["actions", "javascript", "javascript-typescript", "python", "typescript"]
}

GitHub's own language detection for this repo reports four:

{"TypeScript": 78759, "Python": 6411, "Shell": 5328, "JavaScript": 2534}

The language list looks over-broad — javascript, javascript-typescript and typescript overlap, and CodeQL treats javascript-typescript as the single combined analysis. That may or may not be related to the PR-side scheduling failure; I have not confirmed a causal link and am recording it as an observation rather than a diagnosis.

The PR is not from a fork (isCrossRepository: false), so the usual fork-permissions explanation does not apply here.

Why it matters

CodeQL is not in required_status_checks for this repo — protection requires only validate and claude-review / run-review — so this does not block merges at the GitHub level. It does block the local pre-merge hook, which treats NEUTRAL as "found issues needing attention":

[pre-merge] CI checks with NEUTRAL status (indicates unresolved issues):
- CodeQL: NEUTRAL
[pre-merge] Merge blocked - resolve NEUTRAL checks first

That is the right default — NEUTRAL usually does mean unresolved findings, and a security check that silently means "did not run" is the false-OK shape worth being strict about. But the current state means every PR here needs either a hook bypass or a human override, which erodes the check's value either way.

Repro

gh pr view 75 --repo twistedmelonman/personify --json headRefOid --jq .headRefOid
gh api "repos/twistedmelonman/personify/commits/<sha>/check-runs" \
  --jq '.check_runs[] | select(.name|test("CodeQL")) | .output.summary'
gh api repos/twistedmelonman/personify/code-scanning/default-setup
gh api "repos/twistedmelonman/personify/code-scanning/analyses?per_page=10" \
  --jq '.[] | "\(.category)  \(.created_at)"'

Suggested next step

Determine why default setup schedules the three analyses on main but not on PR heads. Trimming the language list to what is actually present (dropping the redundant javascript / typescript entries in favour of javascript-typescript) is the cheapest thing to try first, and is worth doing regardless since the current list claims languages the repo does not contain.

Found while clearing a fleet-wide Dependabot backlog; #75 is still open pending this.