vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-06 12:30:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): narrow CodeQL critical scan (#72982)

Browse Source
This commit is contained in:
Vincent Koc
2026-04-27 11:42:42 -07:00
committed by GitHub
parent 1497425b8d
commit e864fd39cc
6 changed files with 175 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/ci.md
View File

@@ -192,6 +192,16 @@ listed PRs when `apply=true`. Before mutating GitHub, it verifies that the
landed PR is merged and that each duplicate has either a shared referenced issue
or overlapping changed hunks.
The `CodeQL` workflow is intentionally a narrow first-pass scanner, not the
full repository sweep. Daily and manual runs scan Actions workflow code plus the
highest-risk JavaScript/TypeScript auth, secrets, sandbox, cron, and gateway
surfaces. The critical security lane uses high-precision security queries, and
the separate critical quality lane runs only error-severity non-security
queries over the same narrow JavaScript/TypeScript surface. Swift, Android,
Python, UI, and bundled-plugin CodeQL expansion should be added back as scoped
or sharded follow-up work only after the narrow profile has stable runtime and
signal.
The `Docs Agent` workflow is an event-driven Codex maintenance lane for keeping
existing docs aligned with recently landed changes. It has no pure schedule: a
successful non-bot push CI run on `main` can trigger it, and manual dispatch can