From 8d72c6a14b7d1149e1f6aea3c0f7eb9bff38ed9d Mon Sep 17 00:00:00 2001 From: Chelsea Kelly-Reif <3114598+ChelseaKR@users.noreply.github.com> Date: Fri, 17 Jul 2026 00:08:54 -0700 Subject: [PATCH] =?UTF-8?q?ci:=20drop=20redundant=20CodeQL=20push:main=20t?= =?UTF-8?q?rigger=20per=20CI-CD-STANDARD=20=C2=A711e?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pull_request run into main already gates every diff, and the weekly schedule run analyzes refs/heads/main directly, refreshing the canonical default-branch alert state. The per-merge push:main analysis therefore spent two matrix jobs (python + actions) per merge for at most a week of Security-tab bookkeeping latency — pure minutes under the account-wide Actions billing block, with no gate weakened. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01JEt7d9aeBFmPToT46Sciqw --- .github/workflows/codeql.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3df5a4e..408c10c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,14 +1,15 @@ name: codeql -# Vulnerability management: analyze pull requests before merge and the resulting -# default-branch commit after merge. The latter is required for GitHub to update the -# canonical ``refs/heads/main`` alert state; PR-only uploads cannot close that backlog. -# A weekly run still catches newly-discovered query classes with no code change. +# Vulnerability management: analyze pull requests before merge; the weekly run +# analyzes ``refs/heads/main`` directly, which both catches newly-discovered query +# classes with no code change and refreshes the canonical default-branch alert +# state (closing fixed alerts) that PR-only uploads cannot. Per-merge ``push: main`` +# analysis was dropped per CI-CD-STANDARD §11e — the PR run already gated the same +# diff, so the only cost of relying on the weekly run for alert bookkeeping is up +# to a week's latency in the Security tab, not a weaker merge gate. on: pull_request: branches: [main] - push: - branches: [main] schedule: - cron: "27 4 * * 1" # Mondays, 04:27 UTC