Repository navigation
docs(ops): document CodeQL dual-source conflict and Zizmor every-PR enforce - #1764
Conversation
|
This workspace has reached the limit of 50 included PR reviews during your trial. Upgrade to continue receiving PR security reviews. So far, Strix has reviewed 36 pull requests, surfaced 5 security issues (1 critical/high) and blocked 1 risky merge across this workspace. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_4c672c2b-6a0d-409c-9182-1b6990de3435) |
Greptile SummaryThis documentation-only PR updates English and Brazilian Portuguese operational guidance for CodeQL and Zizmor.
Confidence Score: 5/5The PR appears safe to merge because no blocking failure remains. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| .github/workflows/codeql.yml | Updates comments describing the CodeQL dual-source conflict; executable workflow configuration is unchanged. |
| docs/TESTING.md | Expands operator guidance for CodeQL and Zizmor behavior. |
| docs/TESTING.pt_BR.md | Synchronizes the Brazilian Portuguese testing guidance with the English documentation. |
| docs/ops/BRANCH_PROTECTION.md | Updates the branch-protection snapshot with current CodeQL and Zizmor operational details. |
| docs/ops/BRANCH_PROTECTION.pt_BR.md | Synchronizes the Brazilian Portuguese branch-protection guidance. |
Reviews (2): Last reviewed commit: "docs(ops): document CodeQL dual-source c..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| | **CodeQL** | GitHub's semantic code-analysis engine: queries code **as a database** to find security patterns. This repo's advanced workflow is `.github/workflows/codeql.yml` (push / PR / weekly). GitHub **default setup** (`dynamic/github-code-scanning/codeql`) **cannot** run at the same time — GitHub rejects advanced SARIF while default setup is enabled. **See also:** **SAST**, **Semgrep**; [TESTING.md](TESTING.md). | | ||
| | **Semgrep** | Fast, pattern-based **SAST** across many languages. Data Boar runs the OSS `p/python` ruleset in CI. **See also:** **SAST**, **CodeQL**. | | ||
| | **zizmor** | Security linter for **GitHub Actions** workflows (token scope, script injection, unpinned actions). An **enforced** CI gate (issue #732), with an optional local pre-commit stage via `scripts/workflow-security-lint`. **See also:** **SAST**, **CI/CD**, **least privilege**. | | ||
| | **zizmor** | Security linter for **GitHub Actions** workflows (token scope, script injection, unpinned actions). The CI **job fails by default** (issue #732; opt out: repo variable **`ZIZMOR_ENFORCE=false`**). It is **not** a required merge check. Runs on every push/PR (**no** path filter). Optional local pre-commit stage via `scripts/workflow-security-lint`. **See also:** **SAST**, **CI/CD**, **least privilege**. | |
There was a problem hiding this comment.
The changed documentation says Zizmor runs on every push/PR, but the workflow limits push events to main and master. Contributors pushing feature branches without opening or updating a PR will not receive the documented Zizmor run.
Context Used: All documentation must exist in Brazilian Portugue... (source)
…nforce Align operator and contributor docs with live workflows: GitHub default setup still conflicts with .github/workflows/codeql.yml SARIF upload, and zizmor.yml runs on every push/PR with job failure unless ZIZMOR_ENFORCE=false. Issue #1757 stays open until default setup is actually disabled.
3af70f9 to
5d1d22a
Compare
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_b4de18cf-4880-4726-879f-a0d4eea4ad95) |
1 participant
Description
Weekly docs pass: align contributor and operator docs with live GitHub Actions, verified against
.github/workflows/codeql.yml,.github/workflows/zizmor.yml, andgh workflow list --all(2026-08-25).dynamic/github-code-scanning/codeql). GitHub rejects advanced SARIF while default setup is enabled (seen onmain2026-08-12). Comment incodeql.ymlno longer claims default setup is already off.paths:filter); the job fails unlessZIZMOR_ENFORCE=false; not a required merge check; PR checkout ishead.sha. Localcheck-allstill fails on zizmor findings; standaloneworkflow-security-lintstays advisory unless--enforce.Type of change
Issue linking (required)
Closes #NNNNor documentsNo issue closed:aboveDocs added/updated
.github/workflows/codeql.yml(comment only)docs/TESTING.md+docs/TESTING.pt_BR.mddocs/QUALITY_WORKFLOW_RECOMMENDATIONS.md+.pt_BR.mdCONTRIBUTING.md+CONTRIBUTING.pt_BR.mddocs/GLOSSARY.md+docs/GLOSSARY.pt_BR.mddocs/ops/BRANCH_PROTECTION.md+.pt_BR.mdCodepaths covered
.github/workflows/codeql.yml(Pythonsecurity-and-quality, push/PR/weekly)dynamic/github-code-scanning/codeql(not in git).github/workflows/zizmor.yml(ENFORCE_ZIZMOR,head.shacheckout, no secondupload-sarif)scripts/check-all-security-scans.shvsscripts/workflow-security-lint.shKnowledge gaps addressed
ZIZMOR_ENFORCE=falseand has nopaths:filter.🧱 Checklist de Integridade
test_markdown_lint,test_docs_pt_br_locale,test_github_workflows,test_docs_external_no_plan_links) and./scripts/lint-only.sh.cargo clippy --locked— skipped here; cloudrustc 1.83cannot build currentboar_fast_filter(unsigned_is_multiple_of). Docs-only slice.Note
Low Risk
Markdown and workflow comment changes only; no application or CI behavior changes in this diff.
Overview
Documentation-only pass aligning contributor and operator runbooks with live GitHub Actions (verified against
codeql.yml,zizmor.yml, andgh workflow list --all).The
codeql.ymlheader comment no longer states that GitHub default setup is off; it now documents the dual CodeQL source conflict (in-repo advanced workflow vsdynamic/github-code-scanning/codeql), the SARIF rejection error when both are active, and how to detect two active CodeQL workflows.EN + pt-BR updates across CONTRIBUTING, TESTING, GLOSSARY, QUALITY_WORKFLOW_RECOMMENDATIONS, and BRANCH_PROTECTION correct prior drift: Zizmor runs on every push/PR (no
paths:filter), fails by default unless repo variableZIZMOR_ENFORCE=false, is not a required merge check, and useshead.shaon PRs;check-all’s default security tier fails on zizmor while standaloneworkflow-security-lintstays advisory unless--enforce. CodeQL sections explain the advanced workflow, default-setup pitfall, and that CodeQL is advisory for merge.Reviewed by Cursor Bugbot for commit 5d1d22a. Bugbot is set up for automated code reviews on this repo. Configure here.