Skip to content

Make codeql.yml a reusable workflow_call workflow#29

Merged
dduugg merged 1 commit into
mainfrom
add-reusable-codeql
Jul 25, 2026
Merged

Make codeql.yml a reusable workflow_call workflow#29
dduugg merged 1 commit into
mainfrom
add-reusable-codeql

Conversation

@dduugg

@dduugg dduugg commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Every consumer repo (~20 across the org) currently carries its own full copy of codeql.yml, differing only in the language matrix (ruby-only, js/ts-only, rust-only, or some mix, plus actions everywhere). That means fixes like the stale-version-comment cleanup in #28 have to be repeated by hand across every repo instead of landing once here — same problem ci.yml/cd.yml/stale.yml/triage.yml already solved for their own workflows.

Converts codeql.yml to workflow_call, taking the language list as a JSON-array input (e.g. '["actions","ruby"]') instead of a hardcoded matrix. build-mode is now unconditionally none for every language, since that's what every current caller already used (GA since CodeQL 2.23.3, including for Rust/C++).

Since codeql.yml no longer has its own push/pull_request/schedule triggers, shared-config would otherwise stop scanning its own .github/workflows/ — added codeql-self-scan.yml to carry those triggers and call the reusable workflow locally (uses: ./.github/workflows/codeql.yml, not @main, so a PR that edits codeql.yml is tested against its own in-PR version rather than whatever's already on main).

Consumer repos will follow up with a separate PR each, converting their own codeql.yml to a caller like:

jobs:
  analyze:
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: rubyatscale/shared-config/.github/workflows/codeql.yml@main
    with:
      languages: '["actions","ruby"]'

Test plan

  • zizmor .github/workflows/ — 0 findings, offline and with --gh-token
  • actionlint — 0 findings on both new/changed files
  • Confirm codeql-self-scan.yml actually runs and reports results once merged

@dduugg
Make codeql.yml a reusable workflow_call workflow
a041e86 
Every consumer repo currently carries its own full copy of this file,
differing only in the language matrix (ruby-only, js/ts-only, rust-only,
or some mix, plus "actions" everywhere). That means fixes like the
stale-version-comment cleanup in #28 have to be repeated by hand across
~20 repos instead of landing once here, same as ci.yml/cd.yml/stale.yml/
triage.yml already solved for their own workflows.

Converts codeql.yml to workflow_call, taking the language list as a
JSON-array input (e.g. '["actions","ruby"]') instead of a hardcoded
matrix. build-mode is now unconditionally "none" for every language,
since that's what every current caller already used (GA since CodeQL
2.23.3, including for Rust/C++).

Since codeql.yml no longer has its own push/pull_request/schedule
triggers, shared-config would otherwise stop scanning its own
.github/workflows/ - added codeql-self-scan.yml to carry those triggers
and call the reusable workflow locally (`uses: ./.github/workflows/
codeql.yml`, not @main, so a PR that edits codeql.yml is tested against
its own in-PR version rather than whatever's already on main).

Verified with zizmor (offline + --gh-token) and actionlint: 0 findings
on both new/changed files.
@dduugg
dduugg requested a review from a team as a code owner July 25, 2026 05:52
@github-project-automation github-project-automation Bot moved this to Triage in Modularity Jul 25, 2026
@dduugg
dduugg merged commit 5fc5788 into main Jul 25, 2026
4 checks passed
@dduugg
dduugg deleted the add-reusable-codeql branch July 25, 2026 05:53
@github-project-automation github-project-automation Bot moved this from Triage to Done in Modularity Jul 25, 2026
This was referenced Jul 25, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
dduugg added a commit to rubyatscale/bigrails-redis that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#31)
5fef084 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
@dduugg dduugg mentioned this pull request Jul 25, 2026
Merged
2 tasks
dduugg added a commit to rubyatscale/singed that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#71)
ab428e0 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
This was referenced Jul 25, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Merged
dduugg added a commit to rubyatscale/danger-packwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#80)
43c0a94 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code_manifest that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#16)
b85ebd8 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packs-specification that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#34)
a9cd105 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/chatwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#18)
8e7c8b3 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packwerk-vscode that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#21)
c3c224c 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","javascript"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code-ownership-vscode that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#44)
4ab3ff3 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","javascript"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/codeowners-rs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#112)
f4e82cc 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","rust"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/pks that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#40)
41591fc 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","rust"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code_ownership that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#175)
5f3ed93 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby","rust"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/visualize_packs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#116)
b7ce33c 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby","javascript"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#187)
52b9d60 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/packwerk-extensions that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#83)
338ba3b 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/pack_stats that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#67)
7513326 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/rubocop-packs that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#100)
b133392 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/code_teams that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#33)
a5c8bcc 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/parse_packwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#59)
fb863d7 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
dduugg added a commit to rubyatscale/query_packwerk that referenced this pull request Jul 25, 2026
@dduugg
Use shared-config's reusable CodeQL workflow (#39)
0df2d52 
Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","ruby"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

Modularity
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dduugg