Files
codebase-memory-mcp/tests
Martin Vogel 5afdfcaac9 ci(codeql): run CodeQL on main, dry run and release, not per PR
CodeQL ran on every pull_request push, and PR CI's security / codeql-gate
job polled up to 150 min for that run before ci-ok could pass. With ~30 PRs
pushed at once, the gate jobs held runners while the CodeQL runs they waited
for queued behind them, and PR CI starved for hours.

- codeql.yml: triggers are push to main, a weekly schedule, workflow_call
  and workflow_dispatch; pull_request is gone. The open-alert check moves
  here, unchanged and still fail-closed, as the `alerts` job (needs
  analyze), so every main push and every weekly run fails while any
  code-scanning alert is open. Push runs keep cancel-in-progress; called and
  scheduled runs get a group of their own. The analysis key is pinned to the
  push configuration so dry-run/release uploads do not open configurations
  of their own on main.
- _security.yml: codeql-gate removed; callers grant contents: read only.
- dry-run.yml, release.yml: a `codeql` job calls codeql.yml on the
  dispatched commit; release verify needs it and requires success.
- select-lanes.sh, require-all-green.sh: the codeql-gate lane is gone from
  the selector universe and from ci-ok's job map; no other lane changes.
- tests: the fail-closed contract follows the check to codeql.yml and now
  also pins the triggers, the derived callers' grants and release verify;
  lane fixtures drop codeql-gate.
- SECURITY.md, MAINTAINERS.md: say where CodeQL runs now.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
2026-10-20 22:37:22 +02:00
..
2026-10-11 16:57:48 +02:00