Skip to content

fix: missing config-file for github action scanning#5376

Merged
jakobmoellerdev merged 3 commits intoexternal-secrets:mainfrom
Skarlso:fix-codeql-missing-config
Oct 22, 2025
Merged

fix: missing config-file for github action scanning#5376
jakobmoellerdev merged 3 commits intoexternal-secrets:mainfrom
Skarlso:fix-codeql-missing-config

Conversation

@Skarlso
Copy link
Copy Markdown
Contributor

@Skarlso Skarlso commented Sep 26, 2025

Problem Statement

Fixes this error: https://github.com/external-secrets/external-secrets/pull/5368/checks?check_run_id=51328131555

1 configuration not found
Warning: Code scanning cannot determine the alerts introduced by this pull request, because 1 configuration present on refs/heads/main was not found:

Actions workflow (codeql.yml)
❓  .github/workflows/codeql.yml:analyze

Related Issue

Fixes #...

Proposed Changes

How do you like to solve the issue and why?

Format

Please ensure that your PR follows the following format for the title:

feat(scope): add new feature
fix(scope): fix bug
docs(scope): update documentation
chore(scope): update build tool or dependencies
ref(scope): refactor code
clean(scope): provider cleanup
test(scope): add tests
perf(scope): improve performance
desig(scope): improve design

Where scope is optionally one of:

  • charts
  • release
  • testing
  • security
  • templating

Checklist

  • I have read the contribution guidelines
  • All commits are signed with git commit --signoff
  • My changes have reasonable test coverage
  • All tests pass with make test
  • I ensured my PR is ready for review with make reviewable

@github-actions github-actions bot added kind/bug Categorizes issue or PR as related to a bug. size/xs component/github-actions and removed size/xs labels Sep 26, 2025
@Skarlso Skarlso force-pushed the fix-codeql-missing-config branch from babdf53 to adeab55 Compare September 26, 2025 12:49
@Skarlso
fix: missing config-file for github action scanning
a626ff4 
Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com>
@Skarlso Skarlso force-pushed the fix-codeql-missing-config branch from adeab55 to a626ff4 Compare September 26, 2025 12:52
@Skarlso
Copy link
Copy Markdown
Contributor Author

Skarlso commented Sep 26, 2025

So this still fails, but if I make the config files to an incorrect path it actually fails the whole action. So this is trying to load the config to check for from main. I'm guessing this will pass after its merged.

@Skarlso
Copy link
Copy Markdown
Contributor Author

Skarlso commented Sep 26, 2025

If not, some more digging is in order.

@webstradev
Copy link
Copy Markdown
Contributor

webstradev commented Sep 28, 2025

So this still fails, but if I make the config files to an incorrect path it actually fails the whole action. So this is trying to load the config to check for from main. I'm guessing this will pass after its merged.

yeah it runs this of of main and the config files in main, which I guess is a security feature so somebody can't modify it in a PR and thus make their PR pass the codeql checks.

@Skarlso
Copy link
Copy Markdown
Contributor Author

Skarlso commented Sep 28, 2025

Agreed.

@jakobmoellerdev
Copy link
Copy Markdown
Contributor

jakobmoellerdev commented Sep 28, 2025

Not sure here, shouldnt the config be autodetected and generated? Why is this suddenly needed? Maybe im missing the picture. Also why do we disable the default queries?

@Skarlso
Copy link
Copy Markdown
Contributor Author

Skarlso commented Sep 28, 2025

@jakobmoellerdev It's not autogenerated. It will not be detected because it needs to sit on main. And the config is the recommended CodeQL config taken from here: https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/blob/main/configs/synthetics.yml with the slight modification of removing anything irrelevant. :)

@jakobmoellerdev
Copy link
Copy Markdown
Contributor

jakobmoellerdev commented Sep 30, 2025

Then how did we have running scans without config before? https://github.com/external-secrets/external-secrets/blob/5f8b19ac0220b281750fe2dd2cffb069f4e4bca5/.github/workflows/codeql.yml is there a default thats usually drawn?

@Skarlso
Copy link
Copy Markdown
Contributor Author

Skarlso commented Oct 1, 2025

It's only required because I added actions. Before that, everything was fine. 🤔

jakobmoellerdev
jakobmoellerdev approved these changes Oct 20, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@jakobmoellerdev jakobmoellerdev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I still think that by default this shouldnt have been needed. lets add it and observe the workflows though. I will double check this at a later stage but dont wanna block the PR

@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Oct 22, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@jakobmoellerdev jakobmoellerdev merged commit 0a3fdc3 into external-secrets:main Oct 22, 2025
32 checks passed
SamuelMolling pushed a commit to SamuelMolling/external-secrets that referenced this pull request Oct 24, 2025
@Skarlso @jakobmoellerdev @SamuelMolling
fix: missing config-file for github action scanning (external-secrets…
52e9a75 
…#5376)

Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>

On-behalf-of: Gergely Brautigam <gergely.brautigam@sap.com>

Co-authored-by: Jakob Möller <jakob.moeller@sap.com>
Signed-off-by: Samuel Molling <samuelmolling@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jakobmoellerdev jakobmoellerdev jakobmoellerdev approved these changes

@moolen moolen Awaiting requested review from moolen

@riccardomc riccardomc Awaiting requested review from riccardomc

Assignees

No one assigned

Labels

component/github-actions kind/bug Categorizes issue or PR as related to a bug. size/s

Projects

External Secrets
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Skarlso @webstradev @jakobmoellerdev