From 0953d158f5195a84a61cfa92e04a924379244233 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Fri, 23 Oct 2026 14:46:48 +0200 Subject: [PATCH] docs: leave CodeQL out of the templates Public repositories in the org now get CodeQL through default setup (the GitHub recommended security configuration), which rejects results from a separate CodeQL workflow. codeql.yml stays for repositories without it. --- CHANGELOG.md | 4 ++++ README.md | 4 +++- templates/workflows/status-checks-go.yml | 13 ++----------- templates/workflows/status-checks-node.yml | 13 ++----------- templates/workflows/terraform.yml | 9 +-------- 5 files changed, 12 insertions(+), 31 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0f1086c..f8c987f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## Unreleased + +- Templates: no `codeql` job. Public repositories in the organization get CodeQL through default setup, which rejects results from `codeql.yml`. + ## v1.1.3 - `templates/workflows/`: caller templates for new repositories (Status checks for Go and Node, Delivery, Image rescan, Terraform, releases and more), linted by Self CI. They replace the workflow templates for the org `.github` repository, which public repositories could not use while that repository is private. diff --git a/README.md b/README.md index ddef9cc..afc6075 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ Reusable GitHub Actions workflows for the [privacybydesign](https://github.com/p | `node-checks.yml` | npm, Yarn or pnpm install, then lint, test and build | | `npm-publish.yml` | Publishes to npm with Trusted Publishing | | `terraform.yml` | fmt, validate, tflint, Checkov, plan and apply | -| `codeql.yml` | CodeQL for Go, JavaScript/TypeScript and workflow files | +| `codeql.yml` | CodeQL for Go, JavaScript/TypeScript and workflow files, for repositories without CodeQL default setup | | `dependency-review.yml` | Blocks pull requests that add vulnerable or disallowed-licence dependencies | | `workflow-lint.yml` | actionlint and zizmor | | `pr-title.yml` | Checks that pull request titles follow Conventional Commits | @@ -48,6 +48,8 @@ The inputs of each workflow are documented in its file, under `on.workflow_call. On private repositories, artifact attestations are skipped, and `codeql.yml` and `dependency-review.yml` need GitHub Code Security. +In the privacybydesign organization, public repositories get CodeQL through GitHub's default setup (security configuration "GitHub recommended"), so the templates leave out the `codeql` job: with default setup enabled, GitHub rejects results from a separate CodeQL workflow. + ## Versioning Releases are semver tags (`v1.2.0`) with a moving major tag (`v1`), so a release reaches every caller without a change in each repository; breaking changes get a new major. Only maintainers can move `v1`, and changes are tried from a canary repository first. Third-party actions in these workflows are pinned to commit SHAs and kept up to date by Dependabot. See [CHANGELOG.md](CHANGELOG.md). diff --git a/templates/workflows/status-checks-go.yml b/templates/workflows/status-checks-go.yml index dfa3ea7..458f5b6 100644 --- a/templates/workflows/status-checks-go.yml +++ b/templates/workflows/status-checks-go.yml @@ -7,7 +7,7 @@ on: pull_request: merge_group: schedule: - - cron: "17 6 * * 1" # Mondays: CodeQL with fresh queries + - cron: "17 6 * * 1" # Mondays: govulncheck and image scan against fresh databases workflow_dispatch: permissions: {} @@ -35,15 +35,6 @@ jobs: with: push-image: false - codeql: - uses: privacybydesign/github-workflows/.github/workflows/codeql.yml@v1 - permissions: - contents: read - security-events: write - actions: read - with: - languages: '["go", "actions"]' - dependency-review: uses: privacybydesign/github-workflows/.github/workflows/dependency-review.yml@v1 permissions: @@ -60,7 +51,7 @@ jobs: passed: name: Status checks passed if: always() - needs: [go, docker, codeql, dependency-review, workflow-lint] + needs: [go, docker, dependency-review, workflow-lint] runs-on: ubuntu-latest timeout-minutes: 5 permissions: {} diff --git a/templates/workflows/status-checks-node.yml b/templates/workflows/status-checks-node.yml index 13a50b9..5b209b3 100644 --- a/templates/workflows/status-checks-node.yml +++ b/templates/workflows/status-checks-node.yml @@ -7,7 +7,7 @@ on: pull_request: merge_group: schedule: - - cron: "17 6 * * 1" # Mondays: CodeQL with fresh queries + - cron: "17 6 * * 1" # Mondays: govulncheck and image scan against fresh databases workflow_dispatch: permissions: {} @@ -36,15 +36,6 @@ jobs: with: push-image: false - codeql: - uses: privacybydesign/github-workflows/.github/workflows/codeql.yml@v1 - permissions: - contents: read - security-events: write - actions: read - with: - languages: '["javascript-typescript", "actions"]' - dependency-review: uses: privacybydesign/github-workflows/.github/workflows/dependency-review.yml@v1 permissions: @@ -61,7 +52,7 @@ jobs: passed: name: Status checks passed if: always() - needs: [node, docker, codeql, dependency-review, workflow-lint] + needs: [node, docker, dependency-review, workflow-lint] runs-on: ubuntu-latest timeout-minutes: 5 permissions: {} diff --git a/templates/workflows/terraform.yml b/templates/workflows/terraform.yml index af6bd4a..e4b1b79 100644 --- a/templates/workflows/terraform.yml +++ b/templates/workflows/terraform.yml @@ -32,13 +32,6 @@ jobs: secrets: TF_ENV: ${{ secrets.TF_ENV }} - codeql: - uses: privacybydesign/github-workflows/.github/workflows/codeql.yml@v1 - permissions: - contents: read - security-events: write - actions: read - dependency-review: uses: privacybydesign/github-workflows/.github/workflows/dependency-review.yml@v1 permissions: @@ -55,7 +48,7 @@ jobs: passed: name: Status checks passed if: always() - needs: [terraform, codeql, dependency-review, workflow-lint] + needs: [terraform, dependency-review, workflow-lint] runs-on: ubuntu-latest timeout-minutes: 5 permissions: {}