vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-06 09:10:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: split macos codeql shard

Browse Source 
Split the slow macOS CodeQL job into its own weekly/manual workflow and keep the daily CodeQL default on the fast JS/Actions security path.
This commit is contained in:
Vincent Koc
2026-04-28 03:14:07 -07:00
committed by GitHub
parent 6cc6996a1c
commit 77192572f6
3 changed files with 96 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/ci.md
View File

@@ -230,14 +230,19 @@ or overlapping changed hunks.
The `CodeQL` workflow is intentionally a narrow first-pass security scanner,
not the full repository sweep. Daily and manual runs scan Actions workflow code
plus the highest-risk JavaScript/TypeScript auth, secrets, sandbox, cron, and
gateway surfaces with high-precision security queries. macOS remains a manual
security shard so its runtime and alert quality can be tracked separately.
gateway surfaces with high-precision security queries.
The `CodeQL Android Critical Security` workflow is the scheduled Android
security shard. It builds the Android app manually for CodeQL on the smallest
Blacksmith Linux runner label accepted by workflow sanity and uploads results
under the `/codeql-critical-security/android` category.
The `CodeQL macOS Critical Security` workflow is the weekly/manual macOS
security shard. It builds the macOS app manually for CodeQL on Blacksmith macOS,
filters dependency build results out of the uploaded SARIF, and uploads results
under the `/codeql-critical-security/macos` category. Keep it outside the daily
default workflow because the macOS build dominates runtime even when clean.
The `CodeQL Critical Quality` workflow is the matching non-security shard. It
runs only error-severity, non-security JavaScript/TypeScript quality queries
over narrow high-value surfaces. Its baseline job scans the same auth, secrets,