Dependabot cannot run CodeQL with error: 1 configuration not found

[ianhirschfeld]

Select Topic Area

Bug

Body

It seems like this is a bug, but not sure if I am missing a setting.

I have a repo setup with CodeQL, which runs correctly on any pull requests made by a contributor, however when our weekly dependabot scan creates PRs the checks always are blocked at the CodeQL Analyze step. The error is:

1 configuration not found

Warning: Code scanning cannot determine the alerts introduced by this pull request, because 1 configuration present on refs/heads/main was not found

My workflow.yml: https://gist.github.com/ianhirschfeld/4b44f863393f4d28e0d0b9ac086928a5

[ianhirschfeld]

Adding that, pushing an empty commit to the PR, kicks off the checks again which will then run codeql analyze properly

[ginsbach]

Thank you for reporting this!
Can you please share the Workflow file? You can see it linked at the bottom left when you click Details.

[ianhirschfeld]

Added to the main post, here is the link: https://gist.github.com/ianhirschfeld/4b44f863393f4d28e0d0b9ac086928a5

[ginsbach]

Thank you! It looks like you are using the default setup for code scanning, is that correct?

Default setup will not run on PRs from Dependabot.

You will have to switch to advanced setup to remove the requirement for the "Analyze" job and instead use https://github.blog/changelog/2021-06-03-control-which-code-scanning-alerts-cause-a-pull-request-check-to-fail/

[ianhirschfeld]

Gotcha, thank you! I will try that and update here once I verify