[wikithoughts]

What changed

• types is now blocking. ci.yml drops continue-on-error: true from the pyright job, so a pyright error fails types and, through needs, the required ci-ok. The job and check names are unchanged. AGENTS.md (the Typecheck paragraph and the ci-ok sentence) and the [tool.pyright] comment in pyproject.toml now say blocking instead of advisory.

• Every action is pinned to a full commit SHA with a # vX.Y.Z comment, in ci.yml and release.yml. Each SHA was resolved read-only with gh api repos/<owner>/<action>/git/ref/tags/<tag>, following annotated tags down to the commit. Every pin is the commit the floating major tag points to today, so behaviour doesn't change:

  • actions/checkout v5 → fbc6f399… (v5.1.0)
  • actions/setup-python v6 → ece7cb06… (v6.3.0)
  • actions/setup-node v5 → a0853c24… (v5.0.0)
  • actions/upload-artifact v4 → ea165f8d… (v4.6.2)
  • actions/download-artifact v4 → d3f86a10… (v4.3.0)
  • pypa/gh-action-pypi-publish release/v1 → dc37677b… (v1.14.2; the compare API shows it is identical to the release/v1 head)
  • softprops/action-gh-release v2 → 3bb12739… (v2.6.2)
  • github/codeql-action v4 → 24c54180… (v4.38.3)

  The existing github-actions entry in dependabot.yml keeps these pins updated. That file is unchanged.

• New codeql.yml scans Python with build-mode: none. It runs on pushes to main (docs-only pushes skipped, like ci.yml), on every PR, weekly (Mon 04:27 UTC) and on manual dispatch. The top-level token is contents: read; only the analyze job also gets security-events: write. Its concurrency rule matches ci.yml: main runs are never cancelled. It is not a required check. I confirmed read-only that CodeQL default setup is not-configured on the repo, so this advanced workflow won't conflict with it.

Findings addressed

These are the follow-ups from the W5 review (result-W5-passiveworkers-T13T14.md lines 23-30): pyright passed on main but was advisory, actions were not SHA-pinned, and there was no CodeQL.

Verify (run on the rebased head 803ebbf, after #50 landed on main)

• ruff check . && pytest tests/ -q --cov=passiveworkers --cov-fail-under=75 → exit 0: ruff "All checks passed!", 784 passed and 9 skipped, coverage 80.92%
• pyright in a fresh venv built the way CI does it (pip install -e . pyright) → exit 0, 0 errors / 0 warnings / 0 informations. I also ran it on fresh main before any edit: 0 errors. The rerun matters because fix(net): per-route coordinator body caps and counted baseline skips #50 touched passiveworkers/net/*, which this check now gates.
• actionlint .github/workflows/*.yml (v1.7.12, tarball sha256 checked against the release checksums) → exit 0
• Pin check: grep -nE '^\s*-?\s*uses:' .github/workflows/*.yml | grep -vE 'uses: [^@ ]+@[0-9a-f]{40} # v[0-9]+\.[0-9]+\.[0-9]+$' → no output. All 25 uses: lines are pinned (ci 12, release 10, codeql 3).
• No browser check: this PR has no UI.

Unverified

• I didn't watch CI on this PR (the lane brief forbids polling), so the first real CodeQL run and the blocking types run on GitHub have not been observed.
• release.yml only runs on a v*.*.* tag push. Its pinned actions were checked with actionlint but have not been run.
• Older entries in docs/ROADMAP.md, docs/DECISIONS.md (D52), docs/RELEASING.md and CHANGELOG.md still say pyright is "advisory". I left them alone on purpose: they record what shipped in 0.4.0, and they are outside this lane's files.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.