Skip to content

docs: finalize ADR-021 — CodeQL deferred, repo stays private (#113) #242

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oak-pokemon-lab merged 1 commit into from
May 16, 2026
Merged

docs: finalize ADR-021 — CodeQL deferred, repo stays private (#113) #242

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 15 additions & 13 deletions docs/design-decisions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -441,7 +441,7 @@ ATU-CSD-POKEDEX/
## ADR-021 — CodeQL on private repo: decision on repository visibility

**Date**: April 2026
**Status**: Pending — awaiting supervisor discussion
**Status**: Decided — repo stays private, CodeQL deferred

**Context**: CodeQL static analysis was added to the CI pipeline (issue #96) as part of the DevSecOps security scanning strategy. During implementation it was discovered that CodeQL cannot upload results on private repositories without a paid GitHub Advanced Security license. The workflow runs and scans correctly but fails at the upload step with: "Code scanning is not enabled for this repository."

Expand All @@ -452,23 +452,25 @@ ATU-CSD-POKEDEX/
| Make repo public | CodeQL and Semgrep both free; supervisor access easier | None |
| Keep private + GitHub Advanced Security | Full CodeQL on private repo | Paid plan required |
| Keep private + Bandit + Semgrep | Use open-source SAST tools that work on private repos | None |
| Run CodeQL CLI locally | Deep semantic analysis without GHAS | Manual effort |

**Decision**: Keep repo private. Use Bandit (pre-commit + CI) and Semgrep (#97) as SAST tools instead of CodeQL. Revisit repo visibility with supervisor (#113).
**Decision**: Keep repo private. Use Bandit (pre-commit), Semgrep (CI, #97), and pip-audit (CI, #98) as the security scanning stack. CodeQL deferred to post-submission — may run locally via CLI if time permits before 20 May.

**Reason**: This is an academic project. No sensitive code is committed (secrets are gitignored). However, making the repo public is a conscious decision that should involve the supervisor. In the meantime, Bandit and Semgrep provide equivalent SAST coverage for Python and OWASP Top 10 patterns without requiring GitHub Advanced Security.
**Reason**: GitHub Free/Student subscription does not include GitHub Advanced Security for private repos. Making the repo public is a valid option post-submission but not required for the academic deadline. The existing tooling (Semgrep + Bandit + pip-audit) provides equivalent coverage for Python SAST and SCA without platform restrictions.

**Impact**:
- Issue #96 reworked — targets Bandit in CI + pre-commit instead of CodeQL
- Issue #113 created — discuss repo visibility with supervisor
- ADR-021 will be updated once the visibility decision is made

**Update — May 2026: GitHub Copilot PR review also affected**
**Constraints discovered**:
- CodeQL requires GHAS license on private repos (GitHub Free/Student insufficient)
- GitHub Copilot PR review also requires Enterprise subscription on private repos
- Both limitations are subscription-tier restrictions, not technical ones

GitHub Copilot automated PR review (configured in repository settings) does not work for two reasons:
1. **Private repo + student subscription** — Copilot PR review requires either a public repo or a GitHub Enterprise subscription. The student subscription does not qualify.
2. **Token exhaustion** — Copilot tokens are consumed by manual review requests (`request_copilot_review`). Tokens reset on May 15, 2026. Student subscription cannot be upgraded.
**Local alternative documented**: `.agents/issues/237/codeql.md` contains a step-by-step guide for running CodeQL CLI locally (database creation, analysis, SARIF viewing).

@gemini-code-assist gemini-code-assist Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

@edsonesf The ADR references .agents/issues/237/codeql.md as the documentation for the local CodeQL alternative. However, line 471 states that PR #237 was closed without merge. If the content of that PR was not merged into the main branch, this file will not exist in the repository, leading to a broken reference. Please ensure the documentation for the local alternative is actually present in the repository or update the reference to a valid path.

@edsonesf edsonesf May 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The path .agents/issues is explicit ignored by .gitnore and is deemed for local host developtment and agents only.
Considering that CodeQL may be used in future on a local-only purposes, there is no relevance adding it to the repository for now.


**Workaround**: Use `@gemini-code-assist` and `@amazon-q-developer` bots for automated PR review (see CONTRIBUTING.md §6). These work on private repos with no subscription requirement. Manual Copilot reviews can resume after May 15.
**Impact**:
- Issue #96 closed (not planned — platform limitation)
- Issue #113 closed (decision made — stay private)
- PR #107, #237 closed without merge
- Security coverage maintained via Semgrep, Bandit, pip-audit
- Post-deadline: consider making repo public for portfolio visibility + free CodeQL

---

Expand Down
Loading