Compliance: missing-codeql.yml

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: missing-codeql.yml

Detail

Required workflow codeql.yml is missing

Standard Reference

standards/ci-standards.md#required-workflows

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Required workflow codeql.yml is missing

Standard: standards/ci-standards.md#required-workflows

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Required workflow codeql.yml is missing

Standard: standards/ci-standards.md#required-workflows

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Required workflow codeql.yml is missing

Standard: standards/ci-standards.md#required-workflows

[claude]

Claude finished @don-petry's task in 4m 23s —— View job

---

Compliance Fix: Add codeql.yml

• Gather context and read AGENTS.md
• Review the CI standards to understand requirements
• Create codeql.yml workflow (language: actions)
• Commit changes
• Push changes — blocked (see below)

---

Blocker: workflows Permission Required

The push was rejected by GitHub:

refusing to allow a GitHub App to create or update workflow
`.github/workflows/codeql.yml` without `workflows` permission

The Claude Code GitHub App needs the workflows: write permission to push files in .github/workflows/. You can grant this by updating the app's permissions, or use the workaround below.

---

Workaround: Create the file manually

Create .github/workflows/codeql.yml with the following content:

# CodeQL SAST analysis for the .github standards repository.
# This repo contains GitHub Actions workflows, so 'actions' is the configured language.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#2-codeql-analysis-codeqlyml
name: CodeQL Analysis

permissions: {}

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 17 * * 5' # Weekly scan (Friday 12:00 PM EST / 17:00 UTC)

jobs:
  analyze:
    name: Analyze (actions)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: actions

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: /language:actions

Notes on this workflow:

• Language is actions per the standard: "If a repo contains .github/workflows/*.yml, add actions"
• Job name is Analyze (actions) — matches the Analyze (<lang>) pattern required for branch protection checks
• Triggers: push/PR to main + weekly Friday scan (12:00 PM EST)
• Permissions: actions: read, security-events: write, contents: read per the standard
• Uses checkout@v6.0.2 pinned SHA (matching existing workflows in this repo)
• Dependabot (already configured for github-actions) will pin the codeql-action@v3 references to SHAs on its next weekly run

[don-petry]

Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Required workflow codeql.yml is missing

Standard: standards/ci-standards.md#required-workflows

[claude]

Claude finished @don-petry's task in 4m 40s —— View job

---

Fixing Compliance: Add codeql.yml

• Gather context and read standards
• Review CI standards for codeql.yml requirements
• Create .github/workflows/codeql.yml (locally committed)
• Push attempted — blocked (see below)

---

Blocker: workflows Permission Required

The push was again rejected:

refusing to allow a GitHub App to create or update workflow
`.github/workflows/codeql.yml` without `workflows` permission

This is the same blocker as the previous attempt. The Claude Code GitHub App needs the workflows: write permission to push files under .github/workflows/. This cannot be worked around — it is a GitHub security restriction on the App's token.

---

Workaround: Create the file manually

Create .github/workflows/codeql.yml with the following content (based on the standards in ci-standards.md#required-workflows):

# CodeQL SAST analysis for the .github standards repository.
# This repo contains GitHub Actions workflows, so 'actions' is the configured language.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#2-codeql-analysis-codeqlyml
name: CodeQL Analysis

permissions: {}

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 17 * * 5' # Weekly scan (Friday 12:00 PM EST / 17:00 UTC)

jobs:
  analyze:
    name: Analyze (actions)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: actions

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:actions

Notes:

• Language is actions per the standard: "If a repo contains .github/workflows/*.yml, add actions"
• Job name Analyze (actions) matches the Analyze (<lang>) pattern required for branch protection
• Triggers: push/PR to main + weekly Friday scan (12:00 PM EST)
• permissions: {} at top + per-job permissions follows least-privilege policy
• actions: read, security-events: write, contents: read per the standard's permissions table
• checkout is SHA-pinned (matching existing workflows); Dependabot will pin codeql-action@v4 to a SHA on its next weekly run

To grant the workflows permission to Claude Code App (to avoid this blocker in future):
Go to Settings → GitHub Apps → Claude Code → Permissions and add Workflows: Read and write.

[don-petry]

Claude finished @don-petry's task in 2m 47s —— View job

---

Compliance Fix: Add codeql.yml

• Read CI standards
• Create .github/workflows/codeql.yml (committed locally)
• Push attempted — blocked (see below)

---

Blocker: GH_PAT_WORKFLOWS secret not yet active

The push was rejected again:

refusing to allow a GitHub App to create or update workflow
`.github/workflows/codeql.yml` without `workflows` permission

PR #77 added the github_token: ${{ secrets.GH_PAT_WORKFLOWS }} mechanism to the reusable workflow, but the GH_PAT_WORKFLOWS org-level secret doesn't appear to be configured yet (or the PAT doesn't have the workflows scope). Without it, the action falls back to the App token, which lacks workflow write permission.

---

To unblock this issue

Option A — Configure GH_PAT_WORKFLOWS (recommended)

1. Create a classic PAT (or fine-grained PAT) with the workflow scope for your GitHub account
2. Add it as an org-level secret named GH_PAT_WORKFLOWS
3. Re-trigger Claude on this issue (re-apply the claude label) — it will push successfully

Option B — Create the file manually

Create .github/workflows/codeql.yml with:

# CodeQL SAST analysis for the .github standards repository.
# This repo contains GitHub Actions workflows, so 'actions' is the configured language.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#2-codeql-analysis-codeqlyml
name: CodeQL Analysis

permissions: {}

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 17 * * 5' # Weekly scan (Friday 12:00 PM EST / 17:00 UTC)

jobs:
  analyze:
    name: Analyze (actions)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: actions

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:actions

Notes:

• Language actions per the standard: "If a repo contains .github/workflows/*.yml, add actions"
• Job name Analyze (actions) matches the required branch protection check pattern
• permissions: {} top-level + least-privilege per-job (actions: read, security-events: write, contents: read)
• checkout pinned to SHA; Dependabot will pin codeql-action@v4 to a SHA on its next weekly run