Tier 3 SAST triage skipped: PR #54 not merged

[ubercylon8]

Summary

The first-week SAST triage (scheduled for 2026-05-04) could not run because PR #54 has not been merged into main.

Why this blocks the triage

The three CI workflows introduced in PR #54 — Dependabot, CodeQL, and Bandit — only run on the branches/commits where the workflow files exist. Until PR #54 lands on main:

• CodeQL has never scanned the full tests_source/ tree on the default branch, so the Security tab's code-scanning alerts are either empty or sourced only from the PR head commit (not a stable baseline).
• Bandit has not scanned utils/ or limacharlie-iac/scripts/ on main.
• Dependabot is configured in .github/dependabot.yml on the feature branch; Dependabot does not open PRs until that file is present on the default branch.

Running triage against PR-head-only results would produce a misleading baseline and miss the full alert set that appears after a real main-branch scan.

PR #54 current state

Field	Value
PR number	#54
Title	ci: add Dependabot, CodeQL, and Bandit workflows (report-only)
State	open (not merged)
Head branch	feat/security-workflows-tier3
Base branch	main
Created	2026-04-25

Recommended next steps

1. Review and merge PR ci: add Dependabot, CodeQL, and Bandit workflows (report-only) #54 into main. The workflows ship with continue-on-error: true so they are non-blocking.
2. Wait for the first CodeQL scan to complete on main (typically ~10–20 min after merge, triggered by the push event).
3. Re-run this triage once the Security tab shows alerts from a main-branch scan — the triage script expects gh api repos/ubercylon8/f0_library/code-scanning/alerts to return results tied to the default branch.

Ambiguities noted

• It is unclear whether PR ci: add Dependabot, CodeQL, and Bandit workflows (report-only) #54 is blocked on review, or simply hasn't been actioned yet. If it is blocked on a specific concern, please document that on the PR itself so the triage can be rescheduled accordingly.
• If CodeQL was separately enabled via the GitHub UI (outside of PR ci: add Dependabot, CodeQL, and Bandit workflows (report-only) #54), alerts may already exist. In that case, re-run the triage manually — the blocker is specifically the absence of a merged PR ci: add Dependabot, CodeQL, and Bandit workflows (report-only) #54.

---

Auto-filed by triage agent on 2026-05-04. Re-run triage after PR #54 merges.