ci: grant CodeQL the actions:read scope - #5
Merged
Conversation
marsvogel
commented
Jul 24, 2026
Three workflow runs failed on 2026-07-17 while the repository was still private, all because GITHUB_TOKEN cannot reach APIs that are only anonymously readable on public repositories. Scorecard and the build-provenance attestation genuinely require a public repository and cannot be fixed from the workflow side. CodeQL is a real permission gap: codeql-action queries the workflow-run API to attach results to the run, and GitHub's own CodeQL template grants actions:read for exactly that call. Without it the workflow breaks again the moment the repository turns private. Also record two review rules in CLAUDE.md: no explanatory code comments, and never share a session URL in anything that reaches this public repository. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
marsvogel
force-pushed
the
ci/codeql-actions-read-permission
branch
from
July 24, 2026 18:32
92ee03b to
2126238
Compare
marsvogel
changed the title
Doc comments are explanation too: a `///` line that restates the method name carries no information the signature does not already give, and it decays the same way. Only comments a tool acts on stay — Dependabot's version marker, swiftlint directives, and MARK navigation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The language rule listed comments among the things written in English; with comments no longer written at all, the mention is dead weight. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
marsvogel
added a commit
that referenced
this pull request
Jul 24, 2026
…ode (#6) Applies the rule from #5 to everything already in the repository: 43 comment lines in Swift, 27 in the workflows, plus Dependabot config, CODEOWNERS and the build-number script. No comment was merely deleted — each one's content moved into a name, a structure, or a test name: - Weekday enum replaces "Sunday = 1, Saturday = 7"; daysPerWeek replaces the 7. - applicationDidFinishLaunching splits into hideFromDock, makeStatusItem, makeFallbackRefreshTimer, observeDateChanges, makeCalendarPopover; the click handler into showContextMenu and togglePopoverVisibility. The popover is now built before the status item so the button action cannot see a nil popover. - CalendarView's section comments become extracted subviews, and the magic 28/32/5 become weekNumberColumnWidth, dayColumnWidth, firstWeekendSymbolIndex. - The tests' per-assertion comments become 14 named test cases. Comments a tool acts on stay: SHA-pin version markers, swiftlint directives, MARK navigation, .gitignore section headings. Knowledge with no home in code moved to CONTRIBUTING.md, which also states the rule for contributors. Behaviour is unchanged: swiftlint --strict clean, 14 tests pass, Release build succeeds, the app launches. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
marsvogel
added a commit
that referenced
this pull request
Jul 24, 2026
Merging #5 and #6 twenty-eight seconds apart put two Build runs on main at once, and the older one's release step failed with HTTP 403 on POST /releases while the newer one created v1.0.10 without trouble. The 403 was never explained — the job holds contents:write, the protect-main ruleset targets branches rather than tags, and the same configuration succeeded moments later — but two release jobs racing to create refs in one repository is not a state worth keeping either way. The concurrency group queues runs per ref. On main nothing is cancelled, so every merge still produces its release; on pull requests superseded runs are cancelled as before, since a stale PR build has nothing to publish. Known trade-off: three merges in quick succession would leave the middle run queued, and GitHub drops a queued run when a newer one arrives — that commit would get no release. For a repository that merges a few times a month that is a better failure mode than a race. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the three failed-workflow notifications from 2026-07-17 (Build, CodeQL, Scorecard).
What happened
All three runs failed for the same underlying reason: the repository was still private at the time, and
GITHUB_TOKENcannot reach APIs that are only anonymously readable on public repositories.chore/community-best-practices)Resource not accessible by integrationonGET /repos/…/actions/runs/…main)Failed to persist attestation: Feature not available for user-owned private repositoriesmain)ListCommits: … githubv4.Query: Resource not accessible by integrationEvery workflow has been green since publication (Build
29609812831, CodeQL29732358765, Scorecard29731887108), so this PR is hardening — not a fix for a currently broken pipeline.Changes
codeql.yml— addactions: read.codeql-actionqueries the workflow-run API to attach results to the run; GitHub's own CodeQL template grants this scope for exactly that call. Without it the workflow breaks again the moment the repository turns private. Still least-privilege: a read scope on a job that already holdssecurity-events: write.CLAUDE.md— record the two rules from this review: no explanatory code comments, and never share a session URL in anything that reaches this public repository.Scorecard and the build-provenance attestation cannot be fixed from the workflow side — Scorecard would need a PAT via
repo_token, and attestation storage does not exist for user-owned private repositories. Both are documented here rather than in the workflow files.Verification
actionlint .github/workflows/*.ymlpasses.