CodeQL Analyze (python) fails on PR branches cut before main had Python files

[usirin]

Summary

The CodeQL "Analyze (python)" check goes red on any PR branch whose base is older than the first Python files on main. The branch has no Python, so the scan finds nothing and fails. The check is not required, but it shows red and cannot be re-run.

What I was doing

Driving lane 9514 (PR #9525) to ship. The shipper parked the lane on head-ci-red, and I read the PR's failing checks.

What I observed

GitHub's CodeQL default setup added python as a language after #8063 put the first .py files on main. On PR #9525 at head f5f4341, job 106152276286 fails at database finalize:

Error: CodeQL could not process any code written in Python.
Encountered a fatal error while running "codeql database finalize ... codeql_databases/python". Exit code was 32

gh run rerun on that run is refused because default setup has no workflow file. On the same PR a roadmap-guard run from before a later main commit was also red, and the shipper reported head-ci-red with both.

Why it matters

Every open branch older than #8063 carries a red check until it takes main. It might be read as a real CI failure by a shipper or a person, and it may have contributed to a lane park. It stops once old branches drain, so the cost is bounded.

Pointers

• PR fix: A Tuval Claude window holds only system notices, so it renders empty and Load earlier does nothing #9525, job 106152276286
• feat(fabrika): land skill-doctor — byte-exact upstream vendor, fabrika-shaped (#8048) #8063 (first Python files)
• Python files: claude-plugins/fabrika/skills/skill-doctor/scripts/*.py, benchmarks/warp-skill-doctor-import-poc/results/opencode_adapter.py
• review ci --wait settles red on a repo-state check while the diff's own jobs are still queued #9550 (related: review ci settling red on a repo-state check)

Suggested next step (non-binding)

A guess: have the heal-ci path update the branch from main when this is the only red check, or make ship's head-CI read skip non-required checks. Dropping python from the default-setup language list is the other option.

---

_{Filed by an agent · session 1114d1ad-d769-4169-bb00-4d899c13bc18 · branch main · 2026-09-20T22:19:47Z}

[usirin]

Follow-up evidence from the same lane (9514, PR #9525), 2026-09-20.

The second red check on that head was roadmap-guard: [I3] open milestone #57 ("Production-ready kamp.us") is not claimed by any arc or campaign row. Main already carried that row (PR #9544). gh run rerun --failed stayed red because a re-run reuses the old merge snapshot. gh pr update-branch cleared the cause.

The lane operator read both reds as repo-state problems, tried to declare the campaign row itself, was blocked, and parked on head-ci-red. Pulling main into the branch was the fix for both checks. A heal-ci row for "red checks that pass on current main: update the branch" would have avoided the park and the hand fix.

[usirin]

Reproduced on a second branch, and with one fact that narrows the cause.

Reviewing PR #9522 at head d9f433559c7062aa06c025154e6a357dfccc24df, Analyze (python) is the only red in a 49-check rollup. Same annotation this issue quotes:

Error: CodeQL could not process any code written in Python.
Encountered a fatal error while running "codeql database finalize --finalize-dataset ... codeql_databases/python". Exit code was 32

The discriminator: two Analyze (python) check runs exist at that same head, and they disagree.

• Run 35542066204, produced by the repo's own codeql.yml workflow — success.
• Run 35542066098, produced by dynamic/github-code-quality/codeql, run name "Code Quality: PR feat: A red post-merge run on main reaches nobody: 8 failed web deploys sat unseen for 3 days #9522", event dynamic — failure.

So only the default-setup/dynamic analysis reds. The repo-authored CodeQL workflow analyses the identical tree at the identical head and concludes success. That makes this a disagreement between two CodeQL configurations rather than a property of the tree, and it means a fix can be scoped to the default-setup language list without touching codeql.yml.

Two more facts from that head, both arguing the red is cosmetic for the merge gate but not for the people and agents reading it:

• Every ruleset-required context is green — ci-required, scan changed files for leaks, validate skill frontmatter.
• A tree checked out at that head carries zero tracked .py files, so this branch genuinely has no Python, exactly as this issue predicts for a base older than feat(fabrika): land skill-doctor — byte-exact upstream vendor, fabrika-shaped (#8048) #8063.

Cost seen here: the reviewing round had to resolve the red down to the platform product before it could judge the code class at all, because a red rollup is that class's execution evidence.

[usirin]

[usirin]

Folded into #9570 and closed. The observation is real; the symptom has since drained, and what is left of it is already a named alternative on a decision that is open and waiting for a ruling.

The symptom drained — measured today

CodeQL default setup is configured with languages actions, javascript, javascript-typescript, python, typescript, last updated 2026-09-20T21:28:33Z. That is the change the report caught: python joined the list after #8063 put the first .py files on main, and a branch whose head carried no Python failed extraction with exit 32.

Read across every open pull request at the time of triage, Analyze (python) is SUCCESS wherever it ran, and absent on the two branches cut before the language was added (#9362, #9423) — no open PR is red on it. PR #9525, the one the report was filed from, has since merged (cebe0a4c41). A branch cut from main today carries the Python files that make the scan succeed, so the failure mode needs a base older than #8063, and none are open.

The report predicted this itself: "It stops once old branches drain, so the cost is bounded." It did.

Why #9570 is the survivor

#9570 (heal-ci diagnose calls a PR red off a check that gates nothing) is open, type:decision, ready-for:human, on axis:pipeline-hardening. It owns the surface this issue's real cost sits on — a non-required red stranding a merge-eligible PR — and it names this issue as alternative 3 of the ruling it is waiting for:

Neither — fix the check. #9562 records Analyze (python) failing on branches cut before main had Python files. Once those branches drain the symptom goes, and the detector stays as designed. Leaves the next non-required red to strand the next PR.

The measurement above settles the factual half of that alternative and leaves the direction untouched: the branches have drained, so alternative 3 costs nothing now and protects nothing against the next non-required red. That is evidence for the ruling on #9570, not a second ticket.

What is not folded away

Two things in the report have their own homes and are unaffected by this close:

• The false assertion-failure classification on the same CodeQL log is heal-ci classify matched assertion-failure on a benign CodeQL progress line #9572, typed and agent-ready.
• Dropping python from the default-setup language list is a repository security setting, not a pull request, and it trades away Python scanning of claude-plugins/fabrika/skills/skill-doctor/scripts/*.py. If the founder wants that direction it belongs in the heal-ci diagnose calls a PR red off a check that gates nothing #9570 ruling, which is where the alternatives are already written down.

Nothing is ruled here. The direction stays open on #9570 for the founder.