Repository navigation
fix(ci): batch main CodeQL scans weekly - #313
Merged
Merged
Conversation
vincentkoc
marked this pull request as ready for review
November 3, 2026 12:50
Contributor
|
🦞👀 Pull request received. I will update this pull request when review starts. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Problem This Solves
Main pushes repeat CodeQL work in this quiet repository.
User Impact
Batch full Actions, Go and JavaScript/TypeScript default analysis weekly on Mondays at 05:55 UTC while retaining PR/manual scans. Only superseded PR scans cancel. Existing Go/PostgreSQL, TypeScript, compatibility, browser E2E, Docker and three desktop-platform checks remain unchanged. FakeCo/signing/release workflows remain manual controlled; Pages path filters exclude this change.
Why This Change Was Made
The local workflow owns weekly scanning without adding daily work. The one-line root
.ci-policy.mdand changelog record why. Preserve default remote queries, language/build coverage and existing gates. Repository maintainers own language additions, pinned action updates and checking/re-enabling scheduled Actions after 60 days of inactivity. No releases or manual deployment are invoked.Evidence
Actionlint, diff checks, full-context P0–P3 autoreview and independent source/contract review passed. At
1ec6bcff4fa07c02b607bdc1a18197ba18e986f9, full CI41637352923 including browser E2E, all three desktop platforms 41637352968, and default scans 41637347894 passed. Candidate 41637352963 completed 17 Actions, 33 Go and 85 JavaScript security queries, exported all three SARIF files and failed only at expected ownership processing rejection. The review dispatcher initially failed during a service outage; its failed-only rerun 41637353032 passed. Default setup stayed enabled during PR qualification; advanced SARIF ownership rejection is expected and is not successful processed analysis.Source merged as
72d3c86088cc6f64970760e4ed1a21d7fffb40ad. Default merged-main run41639072852 passed before cutover. Full advanced run41644108823 passed; processed analyses2085946806(go),2085946455(javascript-typescript),2085939339(actions) have no errors or warnings. Default setup is off and the advanced workflow is active; security configuration association is unchanged. All 15 existing alert IDs/states and other alert/instance fields are preserved through only the reviewed ownership-metadata transition, and all 442 preceding main analysis records remain. Verified cutover took 195 seconds. The natural weekly trigger has not yet occurred.Maintainers own language additions, action pin updates, and re-enabling scheduled Actions if GitHub disables them after 60 days of inactivity.