From 931f06660fbd021de5907d9019305eddde27731d Mon Sep 17 00:00:00 2001 From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com> Date: Wed, 2 Sep 2026 18:19:54 +0200 Subject: [PATCH 1/3] feat(ci): CodeQL as an advanced-setup workflow that skips plots/** The default setup scanned five languages on every push to an implementation/* branch and every impl-* pull request; during the 4-slot backfill of 2026-09-02 up to 23 CodeQL runs waited in the runner queue at once, ahead of the pipeline's own jobs. The workflow keeps the same languages and weekly schedule but ignores plots/** both as a trigger and inside the analysis. Default setup has to be switched off in the repository settings for the workflow's uploads to be accepted. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01SrKzcwZBnref1sWYtdXynu --- .github/workflows/codeql.yml | 71 ++++++++++++++++++++++++++++++++++++ CHANGELOG.md | 11 ++++++ docs/workflows/overview.md | 1 + 3 files changed, 83 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000000..1cfc10bddba --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,71 @@ +name: "CodeQL" + +# Advanced CodeQL setup, replacing the repository's default setup so the +# generated plot implementations can be left out of scanning. +# +# Under default setup every push to an `implementation/*` branch and every +# impl-* pull request triggered a full five-language scan; during the 4-slot +# backfill of 2026-09-02 up to 23 CodeQL runs sat in the runner queue at once, +# ahead of the pipeline's own jobs. `plots/**` holds generated, AI-reviewed +# plot scripts that run only inside the pipeline's sandboxed render step — +# scanning them has never produced an actionable alert, and the impl-* PRs +# touch nothing else. +# +# Default setup must be switched off in the repository settings (Code +# security → Code scanning) once this workflow lands: GitHub rejects +# advanced-setup uploads while default setup is enabled. + +on: + push: + branches: [main] + paths-ignore: + - 'plots/**' + pull_request: + branches: [main] + paths-ignore: + - 'plots/**' + schedule: + # Weekly, like the default setup it replaces. :23 past the hour dodges + # GitHub's top-of-hour scheduler overload (see daily-regen.yml). + - cron: '23 4 * * 1' + +permissions: + contents: read + security-events: write + actions: read + +concurrency: + group: codeql-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + timeout-minutes: 60 + strategy: + fail-fast: false + matrix: + # Same coverage as the default setup: `javascript-typescript` covers + # both JavaScript and TypeScript; `actions` scans the workflow files. + language: [actions, javascript-typescript, python] + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Initialize CodeQL + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + languages: ${{ matrix.language }} + build-mode: none + # Also keep the plot scripts out of the analysis itself, not only + # out of the triggers: a docs-only push would otherwise still scan + # the thousands of files under plots/. + config: | + paths-ignore: + - plots/** + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + category: "/language:${{ matrix.language }}" diff --git a/CHANGELOG.md b/CHANGELOG.md index ed8a6ead16f..127bce1c51f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,6 +26,17 @@ aggregate instead: an italic *Catalog* line at the end of the version section an ## [Unreleased] +### Changed + +- **CodeQL moves to an advanced-setup workflow that skips `plots/**`** — the default + setup scanned five languages on every push to an `implementation/*` branch and every + impl-* pull request; during the 4-slot backfill of 2026-09-02 up to 23 CodeQL runs + waited in the runner queue at once, ahead of the pipeline's own jobs. The new + `.github/workflows/codeql.yml` keeps the same languages and weekly schedule but ignores + `plots/**` both as a trigger and inside the analysis, so pipeline PRs no longer start + a scan. Default setup has to be switched off in the repository settings for the + workflow's uploads to be accepted. + ### Fixed - **The API image installs `libraqm0`, which is what actually restores text shaping — diff --git a/docs/workflows/overview.md b/docs/workflows/overview.md index 692ad2439b5..dcec0b88dba 100644 --- a/docs/workflows/overview.md +++ b/docs/workflows/overview.md @@ -172,6 +172,7 @@ Located in `.github/workflows/`: | `report-validate.yml` | Validates user-submitted issue reports | | `sync-postgres.yml` | Syncs `plots/` filesystem state to PostgreSQL on push to main | | `sync-labels.yml` | Auto-syncs spec/impl labels after manual PR merges | +| `codeql.yml` | CodeQL scanning (actions, JavaScript/TypeScript, Python) on pushes to main, PRs and a weekly cron; `plots/**` is excluded from triggers and analysis, so pipeline PRs never start a scan | | `ci-lint.yml` | Ruff lint check on PRs | | `ci-tests.yml` | Unit + integration tests on PRs | | `notify-deployment.yml` | Records GitHub deployment events for `app` / `api` | From 1d2e313d3cf70cb1cf3870a778e951bb0b73411c Mon Sep 17 00:00:00 2001 From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com> Date: Wed, 2 Sep 2026 18:21:29 +0200 Subject: [PATCH 2/3] docs(changelog): add PR reference for #11200 Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01SrKzcwZBnref1sWYtdXynu --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 127bce1c51f..daceb58c396 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,7 +35,7 @@ aggregate instead: an italic *Catalog* line at the end of the version section an `.github/workflows/codeql.yml` keeps the same languages and weekly schedule but ignores `plots/**` both as a trigger and inside the analysis, so pipeline PRs no longer start a scan. Default setup has to be switched off in the repository settings for the - workflow's uploads to be accepted. + workflow's uploads to be accepted. (#11200) ### Fixed From 9c490f8c7912975ce5449e0d904a7208cd66732e Mon Sep 17 00:00:00 2001 From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com> Date: Wed, 2 Sep 2026 18:27:29 +0200 Subject: [PATCH 3/3] docs(changelog): move the #11200 entry into the existing Changed section Review feedback: [Unreleased] already had a Changed heading; a second one broke the Keep-a-Changelog structure. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01SrKzcwZBnref1sWYtdXynu --- CHANGELOG.md | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 07810f60839..76df1ccddd5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,17 +26,6 @@ aggregate instead: an italic *Catalog* line at the end of the version section an ## [Unreleased] -### Changed - -- **CodeQL moves to an advanced-setup workflow that skips `plots/**`** — the default - setup scanned five languages on every push to an `implementation/*` branch and every - impl-* pull request; during the 4-slot backfill of 2026-09-02 up to 23 CodeQL runs - waited in the runner queue at once, ahead of the pipeline's own jobs. The new - `.github/workflows/codeql.yml` keeps the same languages and weekly schedule but ignores - `plots/**` both as a trigger and inside the analysis, so pipeline PRs no longer start - a scan. Default setup has to be switched off in the repository settings for the - workflow's uploads to be accepted. (#11200) - ### Fixed - **The watchdog now rescues a repair that crashed after a rejection** — a PR carrying @@ -83,6 +72,14 @@ aggregate instead: an italic *Catalog* line at the end of the version section an ### Changed +- **CodeQL moves to an advanced-setup workflow that skips `plots/**`** — the default + setup scanned five languages on every push to an `implementation/*` branch and every + impl-* pull request; during the 4-slot backfill of 2026-09-02 up to 23 CodeQL runs + waited in the runner queue at once, ahead of the pipeline's own jobs. The new + `.github/workflows/codeql.yml` keeps the same languages and weekly schedule but ignores + `plots/**` both as a trigger and inside the analysis, so pipeline PRs no longer start + a scan. Default setup has to be switched off in the repository settings for the + workflow's uploads to be accepted. (#11200) - **The API image is built in two stages and drops two thirds of its weight** — the single-stage `api/Dockerfile` produced a 1.6 GB image (502 MB compressed in Artifact Registry) of which 277 MB compressed was ballast in two layers: `build-essential`,