ci: add build/validate-only CI workflow for ql/hotspots

[Copilot]

ql/hotspots has no PR-time CI (see #230, a Dependabot bump that ran nothing). The only thing that exercises the generator/patch scripts is hotspots.yml, a manual workflow_dispatch that publishes to GHCR, so the only way to learn whether a dependency bump or script edit broke the pipeline was to run a publish.

This adds .github/workflows/hotspots-ci.yml: the same generate → patch pipeline, stopping at codeql pack create and never publishing. pack create is the compile step pack publish performs internally, so it is the same build minus the upload.

generate job

• Installs ql/hotspots/requirements.txt with --require-hashes on Python 3.12 (the version it was pip-compiled against; it pins cp312-only wheels), byte-compiles the scripts and smoke-tests their CLIs.
• Builds the QL extractor and runs generate-hotspots-queries.py against a github/codeql checkout.
• Fails if any supported language produced a missing or empty (no taint-tracking configuration imports) Hotspots-<language>.ql — a query with zero configs still compiles, so compilation alone is not a sufficient check.
• Uploads the generated queries as an artifact for inspection from the PR.

build-packs job

• Matrix, one entry per language, fail-fast: false, so a break is isolated to and re-runnable for a single language rather than discarding the whole loop.
• Runs patch-codeql.py over a fresh github/codeql checkout, then per language:

codeql pack install "${LANGUAGE}/ql/lib" && codeql pack create "${LANGUAGE}/ql/lib" --output=...
codeql pack install "${LANGUAGE}/ql/src" && codeql pack create "${LANGUAGE}/ql/src" --output=...

Determinism and scope

• Builds against the repo's pinned .codeqlversion CLI and the matching codeql-cli/v<version> tag of github/codeql, rather than hotspots.yml's bundle CLI + github/codeql@main, so a red run points at the PR rather than upstream drift.
• The workflow checks out and executes code from another repository, so it is confined to pull_request (cache scope is the PR branch), the github/codeql ref is not caller-overridable, and nothing derived from that checkout is cached. Earlier drafts with a workflow_dispatch trigger and an extractor cache tripped CodeQL's actions/cache-poisoning queries.
• Swift is excluded: generate-hotspots-queries.py has no Swift support, so no Hotspots-swift.ql exists and the patched Swift pack has nothing to compile. Documented rather than worked around.

Docs

• ql/hotspots/README.md: CI section covering both workflows, a local no-publish build snippet, and a correction to the patch-codeql.py example (--hotspots takes the output directory, not hotspots.csv).
• CONTRIBUTING.md: note that ql/hotspots, though excluded from the codeql pack upgrade loop, now has PR-time CI.

Running the pipeline locally against CLI 2.27.0 and github/codeql@codeql-cli/v2.27.0 suggests nothing is currently broken: all seven languages generate (22–54 configuration imports each) and all seven src packs compile, the slowest being java at ~2m11. Note the workflow run on this PR is currently pending maintainer approval.

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow has one critical credential-persistence issue and two moderate validation issues to address.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Prevent token exposure by disabling persisted checkout credentials · New
• Trigger hotspots validation when .codeqlversion changes · New

What changed in this PR

Adds PR-time, build-only CI for ql/hotspots, validating query generation and per-language CodeQL pack compilation without publishing.

Changes:

• Adds deterministic generation and validation using the pinned CodeQL CLI.
• Adds isolated matrix builds and artifact handling.
• Documents CI behavior and local validation.

File	Summary	Review findings
.github/​workflows/​hotspots-ci.yml	Adds generation, validation, artifact upload, and pack-build jobs.	Critical (1 vote): disable persisted checkout credentials. Moderate (3 votes): include .codeqlversion in path filters. Moderate (1 vote): upload generated artifacts with if: always().
ql/​hotspots/​README.md	Documents CI workflows and local no-publish builds.	None.
CONTRIBUTING.md	Documents dedicated Hotspots PR-time CI.	None.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.