ci: add placeholder required status gate#6
Merged
Conversation
Satisfies the `required` status-check context in org ruleset `default-branch-baseline` (id 15191038, evaluate mode). Placeholder that always passes; this repo'\''s existing CI workflows continue to run independently. Before the ruleset flips to active, harden this job with `needs:` on the existing CI jobs — or swap for a call to a reusable workflow in resq-software/.github.
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 54 minutes and 52 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
WomB0ComB0
added a commit
to resq-software/.github
that referenced
this pull request
Apr 17, 2026
…l dispatch Adds the two deferred reusable workflows: - dotnet-ci.yml: restore, build, format check, test. Configurable dotnet-version (default 9.0.x), solution path, working-directory. - cpp-ci.yml: CMake configure + build + test matrix across ubuntu/macos/windows (configurable). Harden-runner on Linux only (step-security action is Linux-native). Extends required.yml to dispatch the two new languages, and adds proto handling (security-only, no language build dispatched). New inputs: dotnet-version, dotnet-solution, cpp-os-list, cpp-source-dir, cpp-cmake-flags. After this lands, these placeholder consumer PRs can be hardened to call real CI: - resq-software/dotnet-sdk#36 (dotnet) - resq-software/viz#4 (dotnet) - resq-software/vcpkg#6 (cpp) - resq-software/ardupilot#1 (cpp)
Replaces the previous inline cmake/ctest matrix and the placeholder required.yml with a single ci.yml that calls the org-wide `required` aggregator with `lang: cpp` and the correct source-dir + cmake-flags preserved from the prior workflow. Pinned to resq-software/.github@6410acb (the commit introducing cpp-ci.yml). Re-pin to the merge commit or tag after PR#12 lands. Parity: - os matrix: ubuntu + macos + windows (same as before) - source: packages/resq-common (same) - flag: -DRESQ_COMMON_BUILD_TESTS=ON (same) Additionally runs CodeQL for c-cpp and the full security-scan suite via the reusable — upgrade from the prior CI.
Updates @sha from the feat-branch tip to the merge commit of resq-software/.github#12 (f4b51a620aa1bf89c0bce4f434b36f92ff7d517d). Functionally equivalent — same content — but pins to a ref that now exists on main rather than a closed PR branch.
3 tasks
WomB0ComB0
added a commit
that referenced
this pull request
Jun 12, 2026
* fix(security): resolve CodeQL/zizmor code-scanning alerts - env_utils: replace fragile `find(...) != 0` scheme check with the anchored `rfind(prefix, 0) == 0` idiom in validate_url_env (hardens the prefix match; CodeQL #1 is a false positive — env-var config validation, not an authentication barrier — dismissed separately). - ci.yml: drop workflow-level `security-events: write`; grant it only to the `gates` job that runs CodeQL (zizmor excessive-permissions #7). - security.yml: pin the org reusable security-scan.yml to a commit SHA (zizmor unpinned-uses #5), matching ci.yml's existing convention. - add .github/zizmor.yml documenting intentional ignores: secrets-inherit on first-party org reusable callers (#6, #8) and template-injection in gh-aw generated workflow files (#11-20, DO NOT EDIT / maintainer vars). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(env_utils): use strncmp for allocation-free scheme check Address review feedback: check the http(s):// prefix directly on the const char* with std::strncmp instead of constructing a std::string, avoiding an unnecessary heap allocation. strncmp stops at the NUL terminator, so short values remain safe. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/required.ymlalongside existing CI. Placeholder that emits a greenrequiredstatus-check context matched by org rulesetdefault-branch-baseline(id 15191038, evaluate mode). Existing CI workflows continue to run independently.Before flipping the ruleset to active, either add
needs:on this repo's existing CI jobs inrequired.yml, or replace with a reusable-workflow call fromresq-software/.github.Related: resq-software/.github#12.