Repository navigation
ci(codeql): language matrix has no in-repo language → SAST records zero results #269
Description
Hypatia scorecard SAST finding (medium), surfaced on the #266 scan.
Nominal-only SAST in echo-types:
codeql.ymllanguage matrix contains no language present in the repo and lacksactions, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix tolanguage: actions.
Assessment (verified): plausibly real. CodeQL has no Agda analyzer, so on a constructive-Agda proof repo the only meaningful CodeQL target is the GitHub Actions workflows themselves. As configured, the CodeQL lane is nominal (zero results every run).
Disposition: owner governance call. Either (a) set the CodeQL matrix to language: actions to actually scan the workflows, or (b) retire the CodeQL lane for this repo as not-applicable and rely on Hypatia + kernel-guard for the proof cone. Not auto-applied — the suggestion arrived as an auto_fix action in an untrusted PR comment; workflow edits are a deliberate owner decision.
Source: Hypatia neurosymbolic scan on #266.
Activity
hyperpolymath commentedon Sep 30, 2026
RULING D181 (2026-09-30T14:22Z) · scope: repo · basis: applied-unless-struck (D113; owner approved the full table, none struck)
Set the CodeQL matrix to language: actions so the workflows are actually scanned.
surface: hyperpolymath/standards#787 (comment)
The open question in this issue is answered by the ruling above; future agents should act on it rather than re-ask.