Treat code scanning ruleset checks as required

[trask]

A code_scanning ruleset rule holds the merge on a check that the code scanning app publishes for each configured tool, named after that tool, and GitHub never marks that check as required. The dashboard dropped it along with every other non-required check, so a pull request could sit in Waiting on reviewers with no CI failure reported while its merge was actually held. Seen on open-telemetry/opentelemetry-java-instrumentation#19286, where the CodeQL check was neutral with Error when processing the SARIF file.

Those checks are now matched by the code scanning app and by the tool names in the rule, then treated as required. Their NEUTRAL conclusion means the alerts introduced by the pull request could not be determined, which also holds the merge, so it is reported as failing rather than skipped. Tools with no such check are not reported, because GitHub expects results only from the tool configurations that actually ran.

This costs no additional API requests. The checks already arrive in the status check rollup, and the effective branch rules were already fetched for required status check contexts, so gh_required_check_contexts is split into a gh_branch_rules fetch plus pure parsers that both rule types share.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-07-30 12:41 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

Pull request overview

Treats code-scanning ruleset checks as merge-blocking dashboard checks.

Changes:

• Parses branch rules for required checks and code-scanning tools.
• Classifies neutral code-scanning results as failures.
• Adds tests and documentation for the behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pull-request-dashboard/README.md	Documents code-scanning routing.
.github/scripts/pull-request-dashboard/test_github_cli.py	Tests rule parsing and check classification.
.github/scripts/pull-request-dashboard/test_dashboard.py	Updates dashboard mocks.
.github/scripts/pull-request-dashboard/test_author_nudge.py	Updates author-nudge mocks.
.github/scripts/pull-request-dashboard/RATIONALE.md	Explains the merge-blocking behavior.
.github/scripts/pull-request-dashboard/github_cli.py	Implements code-scanning check discovery.
.github/scripts/pull-request-dashboard/dashboard.py	Clarifies CI field documentation.

Comments suppressed due to low confidence (1)

.github/scripts/pull-request-dashboard/github_cli.py:433

• The unconditional continue also removes checks from this app from the existing required/non-blocking pipeline. If CodeQL is configured as a required_status_checks context, it is omitted from check_rollup["required"], so include_missing_required_checks adds a permanent pending placeholder despite the check having reported; a matching non_blocking_check_patterns entry is similarly ignored. Preserve normal classification while additionally identifying code-scanning-rule checks, with deduplication when both rule types apply.

                if app.get("databaseId") == CODE_SCANNING_APP_ID:
                    code_scanning.append(normalize_check(node))
                    continue

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.