Mason Huang b60e8c4838 ci: add process exec CodeQL security shard (#92667) ...

Summary:
- The PR adds a `process-exec-boundary` CodeQL high-security shard, wires it into the CodeQL workflow, expands PR path triggers for process-owning plugin/script paths, and updates CI docs.
- PR surface: Docs +1, Config +87. Total +88 across 3 files.
- Reproducibility: not applicable. this is CI/security-scanner configuration rather than a runtime bug. The behavior is source-reviewable and the exact-head `Security High (process-exec-boundary)` check passed.

Automerge notes:
- No ClawSweeper repair was needed after automerge opt-in.

Validation:
- ClawSweeper review passed for head 066d54b633.
- Required merge gates passed before the squash merge.

Prepared head SHA: 066d54b633
Review: https://github.com/openclaw/openclaw/pull/92667#issuecomment-4698545987

Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Approved-by: hxy91819

2026-07-02 12:50:45 +00:00

..

openclaw-boundary

feat: add codex supervisor extension

2026-05-29 03:49:43 +01:00

codeql-actions-critical-security.yml

chore(ci): widen CodeQL PR guard

2026-04-29 20:06:50 -07:00

codeql-agent-runtime-boundary-critical-quality.yml

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

codeql-android-critical-security.yml

fix(codeql): tune Android pinning profile

2026-04-27 23:04:16 -07:00

codeql-channel-runtime-boundary-critical-quality.yml

chore(channels): remove bluebubbles bundled surface

2026-05-07 12:52:48 -07:00

codeql-channel-runtime-boundary-critical-security.yml

refactor: extract gateway client package (#87797)

2026-05-29 02:23:42 +01:00

codeql-config-boundary-critical-quality.yml

ci: shard config codeql quality

2026-04-28 04:00:14 -07:00

codeql-core-auth-secrets-critical-quality.yml

refactor: extract gateway client package (#87797)

2026-05-29 02:23:42 +01:00

codeql-core-auth-secrets-critical-security.yml

refactor: extract gateway client package (#87797)

2026-05-29 02:23:42 +01:00

codeql-gateway-runtime-boundary-critical-quality.yml

refactor: extract gateway client package (#87797)

2026-05-29 02:23:42 +01:00

codeql-macos-critical-security.yml

fix(ci): add macOS CodeQL security shard

2026-04-27 13:40:34 -07:00

codeql-mcp-process-runtime-boundary-critical-quality.yml

ci: add mcp process codeql quality shard

2026-04-28 23:36:34 -07:00

codeql-mcp-process-tool-boundary-critical-security.yml

refactor: internalize OpenClaw agent runtime (#85341)

2026-05-27 19:24:04 +01:00

codeql-memory-runtime-boundary-critical-quality.yml

chore(deadcode): prune stale codeql paths

2026-06-22 08:33:19 +08:00

codeql-network-runtime-boundary-critical-quality.yml

refactor: extract normalization core package

2026-05-31 01:33:00 +01:00

codeql-network-ssrf-boundary-critical-security.yml

refactor(web): remove provider runtime facade

2026-06-18 10:21:20 +08:00

codeql-plugin-boundary-critical-quality.yml

chore(deadcode): prune stale codeql paths

2026-06-22 08:33:19 +08:00

codeql-plugin-sdk-package-contract-critical-quality.yml

ci: add codeql quality profile input (#74348)

2026-04-29 22:39:54 +08:00

codeql-plugin-sdk-reply-runtime-critical-quality.yml

chore(ci): add Plugin SDK reply CodeQL quality shard

2026-04-29 15:56:41 -07:00

codeql-plugin-trust-boundary-critical-security.yml

chore(deadcode): prune stale codeql paths

2026-06-22 08:33:19 +08:00

codeql-process-exec-boundary-critical-security.yml

ci: add process exec CodeQL security shard (#92667)

2026-07-02 12:50:45 +00:00

codeql-provider-runtime-boundary-critical-quality.yml

chore(ci): add provider runtime CodeQL quality shard

2026-04-29 16:15:38 -07:00

codeql-session-diagnostics-boundary-critical-quality.yml

chore(ci): add session diagnostics CodeQL quality shard

2026-04-29 15:29:03 -07:00

codeql-ui-control-plane-critical-quality.yml

ci: shard control ui codeql quality

2026-04-28 20:24:19 -07:00

codeql-web-media-runtime-boundary-critical-quality.yml

refactor(web): remove provider runtime facade

2026-06-18 10:21:20 +08:00