[bens-agent]

Requested by bens-agent · project thread

Summary

CodeQL ran on every push to main, re-scanning code many times a day. This switches it to one scan a night.

• Trigger: drops main from the push trigger and changes the weekly cron to nightly. Adds workflow_dispatch so a scan can be run by hand.
• Skip when nothing changed: a small changes job runs first and calls the shared mirurobotics/.github/actions/codeql-gate action. On the nightly run it skips the scan if the last successful CodeQL run on main was for the same commit, so repos with a quiet week don't scan the same commit seven times and no repo runs more scans than before. If the API call fails, it scans anyway.
• The weekly full re-scan isn't needed anymore. The CodeQL action is pinned by SHA, so re-scanning an unchanged commit gives the same results. A bump of the action version lands as a commit, which triggers the next nightly scan.

Testing

• The skip logic lives in mirurobotics/.github (actions/codeql-gate, pinned at d2aec01).
• actionlint and yamllint pass on the changed file. The only warnings are line length, plus the Blacksmith runner label, which was already there.
• Ran the skip script (before it moved to .github) against a stubbed gh for these cases: same commit (skips), new commit, no prior run, API failure and manual run (all of these scan).
• The schedule itself can only fire from main, so the first nightly run after merge is the real check. You can also trigger it from the Actions tab with "Run workflow".

🤖 Generated with Claude Code

https://claude.ai/code/session_01LcfazJcxLd3z6H4d7LA1j1

[github-actions]

AI review: approve for b9d23be

I found no blocking issues. This PR only changes CI. CodeQL no longer runs on every push to main; it now runs nightly at 07:31 UTC instead of weekly. You can also start it by hand with workflow_dispatch.

Skip logic. On scheduled runs, the new changes job skips the scan only when the last successful CodeQL run on main was for the same commit. The logic holds up:

• Failures fall back to scanning. If either API call fails, last_sha stays empty, so the scan runs. That includes the case where an empty workflow_id produces an invalid workflows//runs path.
• The current run can't match itself. It is still in progress, so the status=success filter leaves it out.
• Failed scans aren't skipped. A failed scan makes the whole run fail, so it never becomes the "last successful" run, and the next night scans that commit again.
• Skipped runs are safe. A run where the scan was skipped still counts as successful, but that only happens when its commit already had a successful earlier run. So a commit is only skipped after it was really scanned.
• Manual runs and workflow_call always scan. Their event isn't schedule, so they never take the skip path.

Permissions. The changes job's own permissions: actions: read replaces the workflow-level permissions for that job, and that is all it needs. It doesn't check out the repo. The codeql job still gets the workflow-level permissions, including security-events: write.

Change-management note (non-blocking). CodeQL results for main can now be up to about 24 hours behind the latest commit, because the push trigger is gone.

Review run

[github-actions]

AI review: approve for 827f587

I found no blocking issues. This PR only changes CI. Since the last review, the inline skip script has been replaced by a shared action, mirurobotics/.github/actions/codeql-gate, pinned by SHA. The triggers and job wiring are unchanged from the version I approved before:

• CodeQL now runs nightly and can be started by hand.
• codeql runs only when changes outputs scan == 'true'.
• The changes job's own actions: read permission is all the gate needs.
• The codeql job still gets the workflow-level permissions, including security-events: write.

No workflow in this repo calls this one through workflow_call.

I couldn't read the external action from this environment, so I haven't checked that it still behaves like the earlier script: skip only on schedule runs, and scan if the API call fails. If the action ever exits without setting scan, the scan is skipped silently and the run still shows green. I left a non-blocking inline note asking someone to confirm this at the pinned SHA.

Review run

[github-actions]

AI review: approve for fd881d9

No blocking issues. This PR only changes CI. Since the last review (827f587), one thing changed: the codeql job's condition is now !cancelled() && needs.changes.outputs.scan != 'false'. That settles the earlier concern. Only an explicit scan=false from the gate skips the scan. If the gate exits without writing scan, or the changes job fails, the scan still runs, and a failed changes job still makes the run show as failed. A cancelled run skips the scan, which is what you'd expect. Everything else is the same as the version I approved before: CodeQL runs nightly and can be started by hand, the gate action is pinned by SHA, the changes job is limited to actions: read, and the codeql job keeps the workflow-level security-events: write. I still couldn't read the external codeql-gate action from here, so I haven't checked its skip logic itself. With the new condition, a bug in that action can at worst cause an extra scan, never a silently missed one, except when the action wrongly outputs false.

Review run

[ben-miru]

lgtm