From b9d23be91f3bc04358210fe423564c67e25368f9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 21 Oct 2026 02:27:18 +0000
Subject: [PATCH 1/3] ci: run CodeQL nightly instead of on every push to main

Scan main once a night, and skip the scan when main hasn't moved since
the last successful run. Also adds a manual run button.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LcfazJcxLd3z6H4d7LA1j1
---
 .github/workflows/codeql-analysis.yml | 42 ++++++++++++++++++++++++---
 1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index c348784..d641c4e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -1,11 +1,9 @@
 name: CodeQL
 
 on:
-  push:
-    branches:
-      - main
   schedule:
-    - cron: '31 7 * * 3'
+    - cron: '31 7 * * *'
+  workflow_dispatch:
   workflow_call:
 
 permissions:
@@ -15,7 +13,43 @@ permissions:
   security-events: write
 
 jobs:
+  changes:
+    name: Check for new commits
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
+    permissions:
+      actions: read
+    outputs:
+      scan: ${{ steps.check.outputs.scan }}
+    steps:
+      # The nightly run skips the scan when main hasn't moved since the last
+      # successful run, so quiet repos don't rescan the same commit.
+      - name: Check for commits since the last scan
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT: ${{ github.event_name }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+          SHA: ${{ github.sha }}
+        run: |
+          scan=true
+          if [ "$EVENT" = "schedule" ]; then
+            workflow_id=$(gh api "repos/$REPO/actions/runs/$RUN_ID" \
+              --jq .workflow_id) || true
+            runs="repos/$REPO/actions/workflows/$workflow_id/runs"
+            last_sha=$(gh api "$runs?branch=main&status=success&per_page=1" \
+              --jq '.workflow_runs[0].head_sha // ""') || true
+            if [ -n "$last_sha" ] && [ "$last_sha" = "$SHA" ]; then
+              echo "main is still at $SHA, which was already scanned."
+              scan=false
+            fi
+          fi
+          echo "scan=$scan" >> "$GITHUB_OUTPUT"
+
   codeql:
+    needs: changes
+    if: needs.changes.outputs.scan == 'true'
     runs-on: blacksmith-2vcpu-ubuntu-2404
 
     steps:

From 827f587b6a6f3156f366a3a5d7ee03a07baa88f4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 21 Oct 2026 04:20:41 +0000
Subject: [PATCH 2/3] ci: use shared CodeQL gate from .github

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LcfazJcxLd3z6H4d7LA1j1
---
 .github/workflows/codeql-analysis.yml | 21 +--------------------
 1 file changed, 1 insertion(+), 20 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d641c4e..3b42c69 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -26,26 +26,7 @@ jobs:
       # successful run, so quiet repos don't rescan the same commit.
       - name: Check for commits since the last scan
         id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-          EVENT: ${{ github.event_name }}
-          REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          SHA: ${{ github.sha }}
-        run: |
-          scan=true
-          if [ "$EVENT" = "schedule" ]; then
-            workflow_id=$(gh api "repos/$REPO/actions/runs/$RUN_ID" \
-              --jq .workflow_id) || true
-            runs="repos/$REPO/actions/workflows/$workflow_id/runs"
-            last_sha=$(gh api "$runs?branch=main&status=success&per_page=1" \
-              --jq '.workflow_runs[0].head_sha // ""') || true
-            if [ -n "$last_sha" ] && [ "$last_sha" = "$SHA" ]; then
-              echo "main is still at $SHA, which was already scanned."
-              scan=false
-            fi
-          fi
-          echo "scan=$scan" >> "$GITHUB_OUTPUT"
+        uses: mirurobotics/.github/actions/codeql-gate@d2aec010e6ce5c9dd65fb16e6d06a0f61e437734 # main
 
   codeql:
     needs: changes

From fd881d9b175c24635f4d0a099029656f16871f68 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 21 Oct 2026 04:23:13 +0000
Subject: [PATCH 3/3] ci: scan anyway when the CodeQL gate gives no answer

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LcfazJcxLd3z6H4d7LA1j1
---
 .github/workflows/codeql-analysis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 3b42c69..c8509a6 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -30,7 +30,7 @@ jobs:
 
   codeql:
     needs: changes
-    if: needs.changes.outputs.scan == 'true'
+    if: ${{ !cancelled() && needs.changes.outputs.scan != 'false' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
 
     steps: