Hongming Wang 7fbbd482fb ci(codeql): cover main + staging via workflow ... GitHub's UI-configured "Code quality" scan only fires on the default branch (staging), which leaves every staging→main promotion PR unscanned. The "On push and pull requests to" field in the UI has no dropdown; multi-branch scanning on private repos without GHAS isn't available there. Workflow file gives us the control we can't get in the UI: triggers on push + pull_request for both branches. Runs on the same self-hosted mac mini via [self-hosted, macos, arm64]. upload: never — GHAS isn't enabled on this repo so the SARIF upload API 403s. Keep results locally, filter to error+warning severity, fail the PR check on findings, publish SARIF as a workflow artifact. Flipping upload: never → always after GHAS is enabled (if ever) is a one-line change. Picks up the review-flagged improvements from the earlier closed PR: - jq install step (brew, no assumption it's present) - severity filter (error+warning only, drops noisy note-level) - set -euo pipefail - SARIF glob (file name doesn't match matrix language id) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-19 14:34:04 -07:00
..
canary-verify.yml	fix(ci): move canary-verify to self-hosted runner	2026-04-19 11:26:41 -07:00
ci.yml	ci: update GitHub Actions to current stable versions (closes #780)	2026-04-18 12:04:10 -07:00
codeql.yml	ci(codeql): cover main + staging via workflow	2026-04-19 14:34:04 -07:00
e2e-api.yml	fix(ci): update working-directory for workspace-server/ and workspace/ renames	2026-04-18 07:05:44 -07:00
promote-latest.yml	ci(promote-latest): suppress brew cleanup that hits perm-denied on shared runner	2026-04-19 05:55:45 -07:00
publish-canvas-image.yml	ci: update GitHub Actions to current stable versions (closes #780)	2026-04-18 12:04:10 -07:00
publish-workspace-server-image.yml	fix(ci): clone sibling plugin repo so publish-workspace-server-image builds	2026-04-19 05:19:31 -07:00