From 6bac54ec62086a8dc7ae064a8167e61cf1ec56ca Mon Sep 17 00:00:00 2001 From: LiukScot Date: Sun, 24 May 2026 18:09:31 +0200 Subject: [PATCH 1/5] docs(agents): require new CI gates to be added to required checks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prevents merging PRs that introduce correctness-gating jobs without also enforcing them on main — a job not in required checks can be skipped silently. Co-authored-by: Claude Opus 4.7 (1M context) --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index e167e65..7662c9e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -215,6 +215,7 @@ before any of the rules below. shell injection. - Do not skip CI hooks (`--no-verify`, `[skip ci]`, `[ci skip]`) without an explicit reason in the PR description. +- Every new test added must run in a CI job, and every new CI job that gates correctness must be added to `main`'s required status checks in the same PR ## 15. Accessibility (frontend) From 084196a6c5388331b43c9e2d4393d91a82348d76 Mon Sep 17 00:00:00 2001 From: LiukScot Date: Sun, 24 May 2026 19:42:01 +0200 Subject: [PATCH 2/5] ci: switch CodeQL from default to advanced setup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Default Setup auto-skips analysis on PRs that touch only workflow YAML, markdown, etc. With "Analyze (javascript-typescript)" listed as a required status check on main, those PRs got stuck in "Expected — Waiting for status to be reported" forever (e.g. #48). Advanced workflow runs on every PR with no paths-ignore, so the status is always posted. Matrix covers javascript-typescript + actions to match the prior default-setup language coverage. Default Setup must be disabled in Settings → Code security → CodeQL before this lands, otherwise jobs collide on the same category. Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 40 ++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..cf1f435 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,40 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + # No paths-ignore: every PR must post the status so branch protection + # required checks ("Analyze (javascript-typescript)") never stay + # stuck in "Expected — Waiting for status to be reported". + schedule: + - cron: "0 6 * * 1" + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + security-events: write + actions: read + contents: read + strategy: + fail-fast: false + matrix: + language: [javascript-typescript, actions] + steps: + - uses: actions/checkout@v6 + - uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + queries: security-and-quality + - uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{ matrix.language }}" From aad6637b86b0628d0e9a9ac073b363501800b42f Mon Sep 17 00:00:00 2001 From: LiukScot Date: Sun, 24 May 2026 19:47:32 +0200 Subject: [PATCH 3/5] ci: pin checkout SHA + AGENTS.md trailing period MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address reviewer suggestions: - codeql.yml: pin actions/checkout to SHA + version comment to match sibling workflows (claude-pr-review-dependabot.yml, dependabot-lockfile-sync.yml). - AGENTS.md §14: close the new bullet with a period for consistency with siblings. Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 2 +- AGENTS.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cf1f435..9fac49b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,7 +30,7 @@ jobs: matrix: language: [javascript-typescript, actions] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} diff --git a/AGENTS.md b/AGENTS.md index 7662c9e..005bfa0 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -215,7 +215,7 @@ before any of the rules below. shell injection. - Do not skip CI hooks (`--no-verify`, `[skip ci]`, `[ci skip]`) without an explicit reason in the PR description. -- Every new test added must run in a CI job, and every new CI job that gates correctness must be added to `main`'s required status checks in the same PR +- Every new test added must run in a CI job, and every new CI job that gates correctness must be added to `main`'s required status checks in the same PR. ## 15. Accessibility (frontend) From f02b9e0429847e712ada3051a5349c73e134c66a Mon Sep 17 00:00:00 2001 From: LiukScot Date: Sun, 24 May 2026 19:59:15 +0200 Subject: [PATCH 4/5] ci(codeql): pin codeql-action to SHA + disable checkout creds Address CodeRabbit review on #59: - Pin github/codeql-action/init + analyze to commit SHA (v3.36.0 = 03e4368) so workflow can't shift under us if the v3 tag is ever moved. Matches the SHA-pinning style used in sibling workflows (claude-pr-review-dependabot.yml). - Add `persist-credentials: false` to actions/checkout. The CodeQL job has no need to push, so leaving the GITHUB_TOKEN in .git/config after checkout is unnecessary attack surface (artipacked / credential persistence). Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9fac49b..5f48a50 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,10 +31,12 @@ jobs: language: [javascript-typescript, actions] steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: github/codeql-action/init@v3 + with: + persist-credentials: false + - uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0 with: languages: ${{ matrix.language }} queries: security-and-quality - - uses: github/codeql-action/analyze@v3 + - uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0 with: category: "/language:${{ matrix.language }}" From 460c5b633c5736ec0cd3de83176e59e0bf3b2a4e Mon Sep 17 00:00:00 2001 From: LiukScot Date: Sun, 24 May 2026 20:04:30 +0200 Subject: [PATCH 5/5] =?UTF-8?q?ci(codeql):=20revert=20SHA=20pin=20to=20v3?= =?UTF-8?q?=20tag=20per=20AGENTS.md=20=C2=A714?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit AGENTS.md §14 policy: "Track third-party actions at their latest stable tag. Pin to SHA only when an action's repo has had a tag-moving incident." github/codeql-action is GitHub-owned and has had no such incident, so the SHA pin in f02b9e0 violated project policy. Revert to @v3. persist-credentials: false on checkout is kept — that's a separate security best practice unrelated to action versioning. Co-authored-by: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5f48a50..dc5d677 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -33,10 +33,10 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0 + - uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} queries: security-and-quality - - uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0 + - uses: github/codeql-action/analyze@v3 with: category: "/language:${{ matrix.language }}"