[Copilot]

Problem

The CodeQL Security Analysis workflow fails on pull requests from forked repositories with "Resource not accessible by integration" errors. This occurs because forked PRs don't have the necessary GitHub token permissions to upload SARIF results to the base repository's security tab, causing the workflow to fail with a configuration error.

Solution

This PR updates the CodeQL workflow to gracefully handle forked PRs by:

1. Adding minimal required permissions - Added actions: read to the top-level permissions block alongside existing contents: read and security-events: write permissions
2. Skipping analysis on forked PRs - Added a job-level conditional to prevent the analysis job from running when the PR originates from a fork

Changes

# Enhanced permissions block
permissions:
  actions: read          # Added for CodeQL action
  contents: read         # Existing
  security-events: write # Existing

# Job-level conditional to skip forked PRs
jobs:
  analyze:
    if: github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository

Behavior

After this change:

• ✅ Push events to main - CodeQL runs normally
• ✅ In-repo PRs - CodeQL runs normally (same repository PRs)
• ⏭️ Forked PRs - CodeQL job is skipped entirely (no errors)

This approach prevents the token permission error while maintaining full security analysis for all in-repository changes. The workflow uses pull_request_target which runs in the base repository context, so this conditional ensures we only analyze code when we have the necessary permissions to upload results.

Testing

The YAML syntax has been validated and the conditional logic follows GitHub Actions best practices for handling forked repository contributions.

Reference: job run ref d70ba2b844c45be1dbb691dae943db2ea61793e7

Original prompt

Problem: The CodeQL Security Analysis workflow fails on pull requests from forks with errors like "Resource not accessible by integration" due to GitHub token restrictions. This causes a configuration error and prevents SARIF upload.

Task: Update the CodeQL GitHub Actions workflow at .github/workflows/codeql.yml in the SynTechRev/SynTechRev-PolyCodCal repository to prevent CodeQL runs (and result uploads) on pull requests coming from forked repositories and to set minimal permissions required for code scanning when running in-repo.

Requirements:

1. Add a top-level permissions block to request minimal permissions needed by CodeQL and SARIF upload: actions: read, contents: read, security-events: write.
2. Ensure the analysis job (usually named "analyze" or similar) only runs when either the event is not a pull_request (e.g., push or schedule) or when the pull request is from the same repository. Use a job-level if condition such as: if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
3. If the workflow contains an upload step or code-scanning results upload, ensure it is protected by the same condition or will be skipped for forked PRs.
4. Preserve other existing workflow behavior (languages matrix, CodeQL setup, etc.) and only modify control-flow and permissions to avoid unnecessary changes.

Patch to apply (replace or merge into existing file .github/workflows/codeql.yml):

--- Suggested workflow changes ---

Add or update top-level permissions

permissions:
actions: read
contents: read
security-events: write

For the CodeQL analysis job, add a job-level conditional to avoid running on forked PRs

jobs:
analyze:
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
# ... rest of the job configuration stays the same ...

Additionally, ensure any upload or result-posting steps use the same condition or are within this job

Please create a new branch (e.g., copilot/fix-skip-codeql-on-forks) and open a pull request targeting the main branch with the changes. Commit message: "ci: skip CodeQL on forked PRs and set workflow permissions".

Reference: job run ref: d70ba2b. Modify only the workflow file .github/workflows/codeql.yml. Do not create other changes.

This pull request was created as a result of the following prompt from Copilot chat.

Problem: The CodeQL Security Analysis workflow fails on pull requests from forks with errors like "Resource not accessible by integration" due to GitHub token restrictions. This causes a configuration error and prevents SARIF upload.

Task: Update the CodeQL GitHub Actions workflow at .github/workflows/codeql.yml in the SynTechRev/SynTechRev-PolyCodCal repository to prevent CodeQL runs (and result uploads) on pull requests coming from forked repositories and to set minimal permissions required for code scanning when running in-repo.

Requirements:

1. Add a top-level permissions block to request minimal permissions needed by CodeQL and SARIF upload: actions: read, contents: read, security-events: write.
2. Ensure the analysis job (usually named "analyze" or similar) only runs when either the event is not a pull_request (e.g., push or schedule) or when the pull request is from the same repository. Use a job-level if condition such as: if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
3. If the workflow contains an upload step or code-scanning results upload, ensure it is protected by the same condition or will be skipped for forked PRs.
4. Preserve other existing workflow behavior (languages matrix, CodeQL setup, etc.) and only modify control-flow and permissions to avoid unnecessary changes.

Patch to apply (replace or merge into existing file .github/workflows/codeql.yml):

--- Suggested workflow changes ---

Add or update top-level permissions

permissions:
actions: read
contents: read
security-events: write

For the CodeQL analysis job, add a job-level conditional to avoid running on forked PRs

jobs:
analyze:
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
# ... rest of the job configuration stays the same ...

Additionally, ensure any upload or result-posting steps use the same condition or are within this job

Please create a new branch (e.g., copilot/fix-skip-codeql-on-forks) and open a pull request targeting the main branch with the changes. Commit message: "ci: skip CodeQL on forked PRs and set workflow permissions".

Reference: job run ref: d70ba2b. Modify only the workflow file .github/workflows/codeql.yml. Do not create other changes.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Copilot wasn't able to review any files in this pull request.