Skip to content

Make codeql.yml a reusable workflow_call workflow - #29

Merged
dduugg merged 1 commit into
mainfrom
add-reusable-codeql
Jul 25, 2026
Merged

Make codeql.yml a reusable workflow_call workflow#29
dduugg merged 1 commit into
mainfrom
add-reusable-codeql

Conversation

@dduugg

@dduugg dduugg commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Every consumer repo (~20 across the org) currently carries its own full copy of codeql.yml, differing only in the language matrix (ruby-only, js/ts-only, rust-only, or some mix, plus actions everywhere). That means fixes like the stale-version-comment cleanup in #28 have to be repeated by hand across every repo instead of landing once here — same problem ci.yml/cd.yml/stale.yml/triage.yml already solved for their own workflows.

Converts codeql.yml to workflow_call, taking the language list as a JSON-array input (e.g. '["actions","ruby"]') instead of a hardcoded matrix. build-mode is now unconditionally none for every language, since that's what every current caller already used (GA since CodeQL 2.23.3, including for Rust/C++).

Since codeql.yml no longer has its own push/pull_request/schedule triggers, shared-config would otherwise stop scanning its own .github/workflows/ — added codeql-self-scan.yml to carry those triggers and call the reusable workflow locally (uses: ./.github/workflows/codeql.yml, not @main, so a PR that edits codeql.yml is tested against its own in-PR version rather than whatever's already on main).

Consumer repos will follow up with a separate PR each, converting their own codeql.yml to a caller like:

jobs:
  analyze:
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: rubyatscale/shared-config/.github/workflows/codeql.yml@main
    with:
      languages: '["actions","ruby"]'

Test plan

  • zizmor .github/workflows/ — 0 findings, offline and with --gh-token
  • actionlint — 0 findings on both new/changed files
  • Confirm codeql-self-scan.yml actually runs and reports results once merged

@dduugg
Make codeql.yml a reusable workflow_call workflow
a041e86 
Every consumer repo currently carries its own full copy of this file,
differing only in the language matrix (ruby-only, js/ts-only, rust-only,
or some mix, plus "actions" everywhere). That means fixes like the
stale-version-comment cleanup in #28 have to be repeated by hand across
~20 repos instead of landing once here, same as ci.yml/cd.yml/stale.yml/
triage.yml already solved for their own workflows.

Converts codeql.yml to workflow_call, taking the language list as a
JSON-array input (e.g. '["actions","ruby"]') instead of a hardcoded
matrix. build-mode is now unconditionally "none" for every language,
since that's what every current caller already used (GA since CodeQL
2.23.3, including for Rust/C++).

Since codeql.yml no longer has its own push/pull_request/schedule
triggers, shared-config would otherwise stop scanning its own
.github/workflows/ - added codeql-self-scan.yml to carry those triggers
and call the reusable workflow locally (`uses: ./.github/workflows/
codeql.yml`, not @main, so a PR that edits codeql.yml is tested against
its own in-PR version rather than whatever's already on main).

Verified with zizmor (offline + --gh-token) and actionlint: 0 findings
on both new/changed files.
@dduugg
dduugg requested a review from a team as a code owner July 25, 2026 05:52
@github-project-automation github-project-automation Bot moved this to Triage in Modularity Jul 25, 2026
@dduugg
dduugg merged commit 5fc5788 into main Jul 25, 2026
4 checks passed
@dduugg
dduugg deleted the add-reusable-codeql branch July 25, 2026 05:53
@github-project-automation github-project-automation Bot moved this from Triage to Done in Modularity Jul 25, 2026
This was referenced Jul 25, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
dduugg added a commit to rubyatscale/bigrails-redis that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#31)
5fef084 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
@dduugg dduugg mentioned this pull request Jul 25, 2026
Merged
1 of 2 tasks
dduugg added a commit to rubyatscale/singed that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#71)
ab428e0 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
This was referenced Jul 25, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
dduugg added a commit to rubyatscale/danger-packwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#80)
43c0a94 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code_manifest that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#16)
b85ebd8 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packs-specification that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#34)
a9cd105 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/chatwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#18)
8e7c8b3 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packwerk-vscode that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#21)
c3c224c 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","javascript"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code-ownership-vscode that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#44)
4ab3ff3 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","javascript"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/codeowners-rs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#112)
f4e82cc 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","rust"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/pks that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#40)
41591fc 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","rust"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code_ownership that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#175)
5f3ed93 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby","rust"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/visualize_packs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#116)
b7ce33c 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby","javascript"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#187)
52b9d60 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packwerk-extensions that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#83)
338ba3b 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/pack_stats that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#67)
7513326 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/rubocop-packs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#100)
b133392 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code_teams that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#33)
a5c8bcc 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/parse_packwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#59)
fb863d7 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/query_packwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#39)
0df2d52 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
@dduugg dduugg mentioned this pull request Sep 29, 2026
Merged
3 tasks done
dduugg added a commit that referenced this pull request Sep 29, 2026
@dduugg
Document CodeQL and the zizmor check name in the README
5952f2b 
The README never picked up codeql.yml or codeql-self-scan.yml from #29.
Both are now in the tables, with a caller example and the languages
input.

The zizmor section now names the check to require (zizmor / zizmor with
the example), notes that actions: read is only needed in private repos,
and warns that callers tracking @main pick up zizmor-action upgrades,
and any new audits, at once. The job comment in zizmor.yml now says what
callers should grant instead of reading as a guarantee.
dduugg added a commit that referenced this pull request Sep 29, 2026
@dduugg
Make zizmor.yml a reusable workflow_call workflow (#32)
9d489e4 
* Make zizmor.yml a reusable workflow_call workflow

Gem repos can now call zizmor from here instead of carrying their own copy,
as codeql.yml did in #29. zizmor-self-scan.yml keeps the push and PR
triggers and calls it locally, so shared-config still scans itself, with
the same Security tab upload as before.

The advanced-security input defaults to true, the zizmor-action default.
Setting it to false reports findings as annotations and fails the job,
which a required check needs: zizmor exits 0 whenever it writes SARIF.
The job has no permissions block so that it takes the caller's, since
the two modes need different ones.

* Bump zizmor-action to v0.6.4

v0.6.4 makes zizmor 1.30.1 the default. The v0.6.2 pin still ran 1.29.0,
and rubyfmt-action is already on v0.6.3, so moving it onto this workflow
would otherwise be a downgrade. action.sh is unchanged between the two;
action.yml only bumps its upload-sarif pin.

* Document CodeQL and the zizmor check name in the README

The README never picked up codeql.yml or codeql-self-scan.yml from #29.
Both are now in the tables, with a caller example and the languages
input.

The zizmor section now names the check to require (zizmor / zizmor with
the example), notes that actions: read is only needed in private repos,
and warns that callers tracking @main pick up zizmor-action upgrades,
and any new audits, at once. The job comment in zizmor.yml now says what
callers should grant instead of reading as a guarantee.

* Call the self-scan workflows with the $/ self-repository syntax

zizmor 1.30 (now the default via zizmor-action v0.6.4) flags ./ calls
to in-repo workflows with its self-repository audit. $/ resolves to this
repository at the commit that is running, like ./ does, so a PR that
edits zizmor.yml or codeql.yml is still tested against its own version.
GitHub also treats $/ references as pinned under the policy requiring
full-length SHA pins, which ./ references are not.

codeql-self-scan.yml gets the same change, since it would otherwise gain
the same alert on main once this merges.

actionlint 1.7.12 doesn't recognize $/ yet (rhysd/actionlint#711).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

Modularity
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dduugg