Harden CodeQL enforcement and native coverage

[CompleteDotTech]

Problem

CodeQL security analysis is healthy for JavaScript/TypeScript, Rust, Python, and GitHub Actions, and the original high-severity path-injection alert is fixed. The remaining gaps are:

• CodeQL is not currently a required merge protection on main
• the repository's native Swift code is not yet accepted by the main code-scanning configuration
• the separate Code Quality product needs an explicit billing decision before its 2026-07-20 general availability

Latest confirmed security run: https://github.com/OpenCoven/coven-cave/actions/runs/29514716957

Subtasks

• Fix code-scanning alert chore(release): stamp v0.0.39 #122 without changing valid familiar workspace behavior
  • keep the strict familiar-id allow-list
  • pass a CodeQL-recognized sanitized local into workspace resolution
  • add traversal-rejection and declared-workspace regression coverage
  • verified fixed after PR Fix CodeQL familiar contract path alert #3286 merged as 0cdb8ebb7913ab975c79aa9ea2ac8eb2ca11d91e; post-merge main CodeQL run 29514716957 succeeded and alert chore(release): stamp v0.0.39 #122 changed to fixed at 2026-07-16T16:16:24Z
• Add CodeQL merge protection for High and Critical findings
  • preserve and record the existing required CI checks
  • define the repository ruleset: main, tool CodeQL, high_or_higher, alerts threshold none
  • have a repository administrator create the active ruleset — CodeQL merge gate ruleset 19123333, active on main since 2026-07-17T20:40Z
  • verify a pull request is blocked until CodeQL completes and when it reports a new High/Critical finding — rule-suites show code_scanning: fail ("still expecting N results from CodeQL") while analyses are in flight (e.g. suites 3378076322, 3378235633), and pass once uploaded (suite 3378375304 for PR fix(security): finalize CodeQL enforcement — swift audit job, gate parity, Code Quality decision (#3285) #3452); threshold high_or_higher gates new High/Critical findings
• Add Swift CodeQL coverage
  • evaluate default setup: it cannot generate the intentionally untracked Xcode project before Swift autobuild
  • prepare advanced setup in draft PR Add advanced CodeQL coverage for Swift #3287 using macOS, XcodeGen, and a targeted xcodebuild
  • verify Actions, JavaScript/TypeScript, Python, Rust, and Swift all initialize and run queries; run 29515551225 completed the Swift build and extracted 830,387 AST nodes
  • have a repository administrator disable default setup so advanced SARIF uploads are accepted — default setup not-configured, CODEQL_ADVANCED_UPLOAD=always, all four gated categories uploading from the advanced workflow
  • merge Add advanced CodeQL coverage for Swift #3287 and verify all five language categories on main
  • PR ci: drop hosted macOS legs from PR CI (stop Actions-minute exhaustion) #3436 later removed the swift PR leg (macOS budget); its stale main analyses made the merge gate unsatisfiable — fixed in PR fix(security): finalize CodeQL enforcement — swift audit job, gate parity, Code Quality decision (#3285) #3452: stale analyses purged, swift restored as a weekly/dispatch audit job (upload: never, step-summary + SARIF artifact), gate-parity invariant documented in docs/codeql.md
• Review the separate Code Quality analysis and retain or disable it intentionally based on findings and cost
  • inventory: 89 open findings (1 error, 17 warnings, 71 notes) across JavaScript/TypeScript and Python; latest run 29514717094 succeeded
  • identify non-duplicate value: finding #4623 is a real Python syntax error at marketplace/plugins/pptx-generator/skills/pptx-generator/cookbook/carousels/quote-slide.py:88
  • document billing change: GitHub says Actions, active-committer, and AI-credit charges begin 2026-07-20
  • disable before general availability unless the organization explicitly approves the product costs — no approval on record; findings snapshotted (85), the one error-severity finding fixed in PR fix(security): finalize CodeQL enforcement — swift audit job, gate parity, Code Quality decision (#3285) #3452, then PATCH /repos/OpenCoven/coven-cave/code-quality/setup state=not-configured on 2026-07-18 (verified not-configured, AI findings disabled) ahead of the 2026-07-20 GA billing date

Acceptance criteria

• Alert chore(release): stamp v0.0.39 #122 is fixed or closed with evidence from a post-merge main scan.
• Pull requests cannot merge while CodeQL reports a new High or Critical finding or has not completed.
• All currently scanned languages remain covered.
• Swift coverage is enabled, or a documented blocker and follow-up implementation plan is recorded.
• Changes are delivered through scoped PRs with relevant tests and remote CodeQL verification.

[CompleteDotTech]

Started the first scoped implementation in draft PR #3286.

This PR addresses code-scanning alert #122 by adding a CodeQL-recognized sanitizer after the existing strict familiar-id validation, with regression coverage for traversal rejection and declared custom workspaces.

Local verification is green: typecheck, test wiring, and all 194 API test files. The merge-protection and Swift-coverage subtasks remain open in this issue.

[CompleteDotTech]

Progress and live evidence (2026-07-16):

• ✅ Alert chore(release): stamp v0.0.39 #122 is fixed. PR Fix CodeQL familiar contract path alert #3286 merged as 0cdb8ebb7913ab975c79aa9ea2ac8eb2ca11d91e; post-merge main CodeQL run 29514716957 succeeded for Actions, JavaScript/TypeScript, Python, and Rust, and GitHub marked the alert fixed at 2026-07-16T16:16:24Z.
• 🚧 Swift/advanced setup is prepared in draft PR Add advanced CodeQL coverage for Swift #3287. The workflow preserves the four current languages, adds a macOS/XcodeGen/manual Swift build, pins its actions, and documents activation and rollback.
  • Run 29515551225 installed XcodeGen, initialized the Swift extractor, generated the project, completed xcodebuild, extracted 830,387 Swift AST nodes, ran the security queries, and produced SARIF.
  • All five language legs failed only when GitHub processed the upload, with the expected message: CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled.
• 🔒 The remaining settings are admin-gated. The authenticated romgenie credential reports repository write, not admin; GitHub rejected ruleset creation and default-setup configuration. The required ruleset is: target main, tool CodeQL, security threshold high_or_higher, alerts threshold none, preserving all existing required checks.
• 💰 Code Quality is not a duplicate security scan: the live API reports 89 open standard findings (1 error, 17 warnings, 71 notes; 15 reliability and 74 maintainability). The error is finding #4623, a real Python syntax error in marketplace/plugins/pptx-generator/skills/pptx-generator/cookbook/carousels/quote-slide.py:88. The latest two-language Code Quality run 29514717094 succeeded.
• ⚠️ GitHub says Code Quality leaves public preview and begins charging for Actions, active committers, and AI credits on 2026-07-20: https://docs.github.com/en/enterprise-cloud@latest/billing/concepts/product-billing/github-code-quality. Recommendation: disable it before July 20 unless the organization explicitly approves those product costs; keep security CodeQL enabled through the advanced workflow.

The issue remains open and the Bead remains in progress until the admin transition, five-language main scan, and ruleset verification are complete.

[CompleteDotTech]

@BunsDev — could you help complete the remaining admin-gated items on this issue?

1. Disable CodeQL default setup so advanced-analysis SARIF uploads are accepted.
2. Rerun draft PR Add advanced CodeQL coverage for Swift #3287 and confirm all five advanced legs pass: Actions, JavaScript/TypeScript, Python, Rust, and Swift. The prior Swift leg already generated the Xcode project, completed xcodebuild, extracted 830,387 AST nodes, and ran queries; it failed only at the default-setup upload gate.
3. After Add advanced CodeQL coverage for Swift #3287 merges and the five-language main scan succeeds, create an active main ruleset requiring tool CodeQL with security threshold high_or_higher and alerts threshold none, preserving the current required CI checks.
4. Disable Code Quality before its 2026-07-20 paid GA unless OpenCoven explicitly approves its Actions, active-committer, and AI-credit costs.

The live checklist and evidence are in the issue body and the preceding progress comment. Alert #122 itself is already fixed and verified on main.

[BunsDev]

CodeQL Hardening — MIGRATION variant landed ✅

What happened:

• Default-setup CodeQL disabled (already done in prior step)
• CODEQL_ADVANCED_UPLOAD repo var set to always (already done in prior step)
• All 5 language SARIFs verified on a main-branch advanced-workflow run after 2026-07-17T19:52Z:
  • actions — 2026-07-17T20:10:00Z
  • javascript-typescript — 2026-07-17T20:12:14Z
  • python — 2026-07-17T20:10:09Z
  • rust — 2026-07-17T20:11:15Z
  • swift — 2026-07-17T20:30:23Z
• Ruleset created (id: 19123333, name: main protection (checks + CodeQL), enforcement: active):
  • deletion block
  • non_fast_forward block
  • 5 required status checks: Frontend build, Rust check, E2E (Playwright), Cross-environment required, Sidecar runtime required
  • CodeQL code_scanning gate: high_or_higher security alerts threshold, tool=CodeQL

Classic branch protection: left intact. It still carries enforce_admins=true + force-push/deletion blocks. The 5 required checks are now duplicated between classic and the new ruleset — this is safe (layering). Val can strip the duplicate required checks from classic manually if she wants a single source of truth, but nothing is broken as-is.

No issue close — per plan, leaving open for Val to review and clean up classic protection if desired.