docs: finalize ADR-021 — CodeQL deferred, repo stays private (#113)#242
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request finalizes the architectural decision regarding repository visibility and security tooling. It addresses platform-specific limitations encountered with GitHub Advanced Security and Copilot on private repositories, ensuring the project maintains robust security coverage through alternative open-source tools while documenting the path forward for future visibility changes. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
@edsonesf This PR successfully finalizes ADR-021 with clear documentation of the platform constraints and decision rationale. The changes are well-structured and appropriate for closing issue #113.
Summary:
✅ Status updated from "Pending" to "Decided"
✅ Clear documentation of GHAS platform limitation
✅ Comprehensive security scanning stack documented (Semgrep + Bandit + pip-audit)
✅ Local CodeQL CLI alternative referenced
✅ Impact section clearly lists closed issues and maintains security coverage
✅ No hardcoded secrets
✅ Commit messages follow standard
✅ Scope discipline maintained (single documentation file)
No blocking issues found. This documentation change appropriately captures the architectural decision and its rationale.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates ADR-021 in docs/design-decisions.md to finalize the decision to keep the repository private and defer CodeQL integration due to GitHub Advanced Security licensing constraints. The security strategy now focuses on Bandit, Semgrep, and pip-audit, with a local CodeQL CLI option documented. A review comment correctly identifies a potential broken link to documentation located in a pull request that was closed without being merged, which could lead to a missing file in the main branch.
| GitHub Copilot automated PR review (configured in repository settings) does not work for two reasons: | ||
| 1. **Private repo + student subscription** — Copilot PR review requires either a public repo or a GitHub Enterprise subscription. The student subscription does not qualify. | ||
| 2. **Token exhaustion** — Copilot tokens are consumed by manual review requests (`request_copilot_review`). Tokens reset on May 15, 2026. Student subscription cannot be upgraded. | ||
| **Local alternative documented**: `.agents/issues/237/codeql.md` contains a step-by-step guide for running CodeQL CLI locally (database creation, analysis, SARIF viewing). |
There was a problem hiding this comment.
@edsonesf The ADR references .agents/issues/237/codeql.md as the documentation for the local CodeQL alternative. However, line 471 states that PR #237 was closed without merge. If the content of that PR was not merged into the main branch, this file will not exist in the repository, leading to a broken reference. Please ensure the documentation for the local alternative is actually present in the repository or update the reference to a valid path.
There was a problem hiding this comment.
The path .agents/issues is explicit ignored by .gitnore and is deemed for local host developtment and agents only.
Considering that CodeQL may be used in future on a local-only purposes, there is no relevance adding it to the repository for now.
oak-pokemon-lab
left a comment
oak-pokemon-lab
left a comment
There was a problem hiding this comment.
We do the best we can with the resources we have.
|
2 participants
Summary
Finalizes ADR-021 — CodeQL deferred, repository stays private. Documents the platform limitation (GHAS required for private repos on GitHub Free/Student) and confirms the existing security stack (Semgrep + Bandit + pip-audit) as sufficient.
Changes
docs/design-decisions.md— ADR-021 status updated from "Pending" to "Decided", added local CLI alternative reference, removed outdated Copilot section (folded into constraints)Checklist
Closes
Closes #113
Reviewers
🤖 Bot reviewers: please tag @edsonesf in your feedback so I can act on it.