fix(codeql): grant private consumers pull-request and status reads

[seonghobae]

Problem

The org-required workflow .github/workflows/codeql-pr.yml fails both of its jobs whenever a private consumer repository runs it. In ContextualWisdomLab/late-life-anxiety-reanalysis PR #10 (head a1cd5bc6783c6510dfcf937f523c733366e82213, run 34700410434), both jobs failed at their first API call with gh: Resource not accessible by integration (HTTP 403):

• CodeQL compatibility analysis (python) (job 103571590442), step "Read current-head CodeQL dispatch verdict", calling gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}" under a token whose effective permissions were only Contents: read, Metadata: read (declared contents: read, id-token: write).
• Dispatch current-head CodeQL scan (job 103571810868), the same GET plus a later read of repos/${TARGET_REPOSITORY}/commits/${PR_HEAD_SHA}/statuses, under contents: read, id-token: write, actions: read.

Public consumers (fast-mlsirm, pg-erd-cloud, naruon, html4tree) passed only because an unauthenticated-equivalent GET on a public repository doesn't require the grant. GitHub's REST contract requires pull-requests: read for "Get a pull request" and statuses: read for "List commit statuses for a reference" on private repositories.

Boundary

• Adds only pull-requests: read and statuses: read to the analyze-head and dispatch-current-head job permissions: blocks in .github/workflows/codeql-pr.yml.
• No write permission is added anywhere. actions: write remains absent, still guarded by the existing test_codeql_required_workflow_does_not_gain_actions_write test.
• Declaration order preserved: contents, id-token, [actions], pull-requests, statuses.

TDD evidence

RED — new focused test before the fix:

$ GITHUB_ACTIONS=true python3 -m pytest tests/test_codeql_pr_workflow_contract.py -q -k private_consumers
...
E           AssertionError: assert [] == ['read']
1 failed, 20 deselected in 0.89s

GREEN — same test after the fix:

$ GITHUB_ACTIONS=true python3 -m pytest tests/test_codeql_pr_workflow_contract.py -q -k private_consumers
1 passed, 20 deselected in 0.38s

Focused suite (five CodeQL / required-workflow contract files): 149 passed.

Full repository suite: 3040 passed, 1 skipped, 36 subtests passed in 471.09s (the 1 skip is pre-existing and unrelated: tests/test_opencode_rust_coverage_toolchain_contract.py:195, reviewed LLVM 19 tools not installed on this host). No warnings.

actionlint -shellcheck= -pyflakes= .github/workflows/codeql-pr.yml: clean (exit 0, no output).

Hosted acceptance still required

This repair is unverified against GitHub's live permission enforcement. A newly loaded central SHA carrying this change must still pass both analyze-head and dispatch-current-head on the private consumer's exact current head before this is resolved end-to-end. Separately, the later repository_dispatch POST from dispatch-current-head to ContextualWisdomLab/.github using the OpenCode app token has not yet been exercised from a private consumer at all, and may surface a distinct scoping issue of its own once this read-permission blocker is cleared.

Refs ContextualWisdomLab/late-life-anxiety-reanalysis#10.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 51 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 13b501d2-f260-4ff6-b1af-c2375caaf4d0

📥 Commits

Reviewing files that changed from the base of the PR and between fb17ef5 and 4ba16a4.

📒 Files selected for processing (4)

• .github/workflows/codeql-pr.yml
• CHANGELOG.md
• docs/doctoring/codeql-pr-private-consumer-read-permissions.md
• tests/test_codeql_pr_workflow_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Infrastructure-exception merge record (operator guideline §11), head 4ba16a454c2145f94f158bf7f21a702f34fc89a3 on main 0ad785de2055f2edd084268ca9238b0fab551160.

Substantive gates passed on this head: Bandit, Semgrep (multi-language), gitleaks, pip-audit, required-workflow-bootstrap, scan-pr-queue, coverage-evidence, Dispatch current-head CodeQL scan. Effective token on the run itself shows the new grants applied (PullRequests: read, Statuses: read), no write grant added.

Not terminal at merge time: the two CodeQL shards are in their designed pending-fail state waiting for codeql-scan-dispatch run 34738188389, which is queued behind the saturated organization Actions queue (#712, #1531); noema-review/strix/opencode-review depend on the review sidecar whose free-pool preflight has been rejecting all routes (HTTP 429, see #2121 record). None produced a finding against this 4-line read-only permission diff.

Substitute verification: RED→GREEN contract test, 149 focused / 3040 full tests pass, actionlint clean (PR body). Deferred verification to re-run after merge: CodeQL (actions) on main and the consumer's exact-head CodeQL shards on late-life-anxiety-reanalysis PR #10; if either surfaces a finding attributable to this change, revert.