From 1e237981d44fe7763aa581d2d7529a0bc8ee21e4 Mon Sep 17 00:00:00 2001 From: Lukas Geiger Date: Sat, 7 Nov 2026 17:40:35 +0100 Subject: [PATCH 1/2] test(metadata): red test, CodeQL must run through the GitHub default setup only The repository has the GitHub default setup for code scanning (python, actions, weekly, default suite, configured since 2026-07-22). The own workflow .github/workflows/codeql.yml is a second configuration: its analyze job fails on every run with 'advanced configurations cannot be processed when the default setup is enabled' (push to main c381595, pull request, schedule). The old contract test required the file; the new one forbids it and any codeql-action step. Fails against c381595 (codeql.yml exists). Refs: T-20261107-558181168 Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01THB2EysTVQFXz5moenpBvW --- tests/test_metadata.py | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/tests/test_metadata.py b/tests/test_metadata.py index e227834..13e348e 100644 --- a/tests/test_metadata.py +++ b/tests/test_metadata.py @@ -844,15 +844,16 @@ def test_dependabot_actions_and_pip_guard() -> None: assert "open-pull-requests-limit: 3" in content -def test_codeql_concurrency_guardrail() -> None: - """Verify .github/workflows/codeql.yml defines concurrency and least-privilege permissions.""" - codeql_path = ROOT / ".github" / "workflows" / "codeql.yml" - assert codeql_path.is_file(), "codeql.yml must exist" - content = codeql_path.read_text(encoding="utf-8") - assert "concurrency:" in content - assert "cancel-in-progress: true" in content - assert "security-events: write" in content - assert "languages: python" in content +def test_codeql_runs_through_the_github_default_setup_only() -> None: + """Das Repo nutzt das GitHub-Default-Setup fuer Code-Scanning (python, actions, woechentlich). + + Ein eigener CodeQL-Workflow waere eine zweite Konfiguration und liesse den Check ``analyze`` bei jedem + Lauf scheitern ("advanced configurations cannot be processed when the default setup is enabled"). + """ + workflows = ROOT / ".github" / "workflows" + assert not (workflows / "codeql.yml").exists(), "codeql.yml doppelt die Default-Konfiguration" + for workflow in sorted(workflows.glob("*.y*ml")): + assert "github/codeql-action/" not in workflow.read_text(encoding="utf-8"), workflow.name def test_pep621_maintainers_and_classifiers() -> None: From aadf0435ae4f5186a055d2b23977ee35f9a2361c Mon Sep 17 00:00:00 2001 From: Lukas Geiger Date: Sat, 7 Nov 2026 17:42:15 +0100 Subject: [PATCH 2/2] ci(codeql): remove the duplicate CodeQL workflow, keep the GitHub default setup T-20261107-558181168. The GitHub default setup for code scanning is configured for this repository (languages python and actions, weekly, default suite, since 2026-07-22). The own workflow added on 2026-10-30 is a second configuration; its analyze job failed on every run (push to main c381595, pull request, schedule) with "advanced configurations cannot be processed when the default setup is enabled". The default setup already covers Python and GitHub Actions, so no coverage is lost. The contract test that required the file now forbids it. The red test of 1e23798 passes; tests/test_metadata.py, test_docs_contracts.py and test_security_license_contract.py: 57 passed. Refs: T-20261107-558181168 Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01THB2EysTVQFXz5moenpBvW --- .github/workflows/codeql.yml | 34 ---------------------------------- CHANGELOG.md | 4 ++++ 2 files changed, 4 insertions(+), 34 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 7798cdf..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: CodeQL - -on: - push: - branches: [main] - pull_request: - branches: [main] - schedule: - - cron: "17 4 * * 1" - workflow_dispatch: - -permissions: - contents: read - security-events: write - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - analyze: - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Check out repository - uses: actions/checkout@v4 - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: python - - - name: Analyze - uses: github/codeql-action/analyze@v3 diff --git a/CHANGELOG.md b/CHANGELOG.md index d133dfb..4541b28 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ ## Unreleased +- CodeQL runs through the GitHub default setup only; the own workflow `.github/workflows/codeql.yml` is removed (T-20261107-558181168) on 2026-11-07: + - The repository has the GitHub default setup for code scanning (python and actions, weekly, default query suite, configured since 2026-07-22). The workflow from 2026-10-30 was a second, "advanced" configuration, and its `analyze` job failed on every run (push, pull request, schedule) with "advanced configurations cannot be processed when the default setup is enabled". The default setup already covers Python and GitHub Actions; no coverage is lost. + - `tests/test_metadata.py`: the contract test that required the workflow now forbids it and any `github/codeql-action` step. To switch to an advanced setup later, change the repository setting first and add the workflow in the same step. + - Automation control no longer hides unreadable `automation.toml` files and writes them atomically (T-20261101-844031160) on 2026-11-07: - Unreadable definitions are reported, not skipped: `scan_automations()` returns them next to the readable records (`UnparseableAutomation`: folder name, path, error text), `find_automation_anomalies()` has a new `unparseable` category, and `diagnose()` lists them in the report (`unparseable_automations`, shown by `to_text()`) without a new issue code, so the public health exchange contract v1 stays unchanged. `load_automations()` keeps its signature and still returns only the readable records. This matters for the duplicate `model`/`reasoning_effort` keys of 2026-10-31, which tomlkit rejects as `ParseError`: 94 of 113 files would have been invisible to pause, restore and the anomaly check. - Pause, restore and activate-all list every unreadable definition (folder, path, error) in `errors` and in the new `unparseable_ids`, so `status` is never `ok` and the tray and the orchestrator show it as partial or failed. IDs that CareCenter paused earlier stay remembered while their file is unreadable; an unreadable file CareCenter never paused is not adopted, so a later restore cannot activate something the user paused.