From 04426fba8f166c0cfb3e765b783e76792bb6180f Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Tue, 3 Nov 2026 20:26:01 +0800
Subject: [PATCH 1/2] fix(ci): avoid duplicate main-push CodeQL scans

---
 .ci-policy.md                |  1 +
 .github/workflows/codeql.yml | 14 +++-----------
 CHANGELOG.md                 |  2 ++
 src/ci-workflow.test.ts      | 24 ++++++++++++++++++++++++
 4 files changed, 30 insertions(+), 11 deletions(-)
 create mode 100644 .ci-policy.md
 create mode 100644 src/ci-workflow.test.ts

diff --git a/.ci-policy.md b/.ci-policy.md
new file mode 100644
index 0000000..8f1eee4
--- /dev/null
+++ b/.ci-policy.md
@@ -0,0 +1 @@
+CodeQL keeps its full weekly Monday 07:23 UTC scan instead of scanning each main push because this repository is quiet; PR and manual profile scans remain available, and ordinary CI, deployment, and release workflows are unchanged.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b2ed047..1a646a3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -12,19 +12,11 @@ on:
           - all
           - typescript
           - actions
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/codeql/**"
-      - ".github/workflows/**"
-      - "src/**"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "tsconfig*.json"
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
     paths:
+      - ".gitattributes"
+      - "**/.gitattributes"
       - ".github/codeql/**"
       - ".github/workflows/**"
       - "src/**"
@@ -35,7 +27,7 @@ on:
     - cron: "23 7 * * 1"
 
 concurrency:
-  group: codeql-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event_name == 'pull_request' && github.event.pull_request.number || github.sha }}
+  group: codeql-${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 521d6ef..8988f76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## 0.8.5 - Unreleased
 
+- Keep full weekly CodeQL analysis without duplicate main-push scans, isolate scheduled and manual runs, and scan PRs that change checkout attributes.
+
 - Avoid duplicate CI compilation by retaining the package smoke test's clean prepack build.
 - Refresh Oxfmt, test tooling, CodeQL, and TruffleHog within the 48-hour dependency policy while preserving Node 22 support. Thanks @dependabot! #249 #250
 
diff --git a/src/ci-workflow.test.ts b/src/ci-workflow.test.ts
new file mode 100644
index 0000000..440c4f1
--- /dev/null
+++ b/src/ci-workflow.test.ts
@@ -0,0 +1,24 @@
+import { readFile } from "node:fs/promises";
+import { expect, it } from "vitest";
+
+it("preserves weekly CodeQL and admits checkout-attribute PR changes", async () => {
+  const workflow = await readFile(".github/workflows/codeql.yml", "utf8");
+  const header = workflow.split("\njobs:\n", 1)[0];
+  const pr = header.split("  pull_request:\n")[1]?.split("  schedule:\n")[0];
+
+  expect(header).not.toMatch(/^  push:/mu);
+  expect(header).toContain('cron: "23 7 * * 1"');
+  expect(pr).toContain('      - ".gitattributes"');
+  expect(pr).toContain('      - "**/.gitattributes"');
+  expect(pr).toContain('      - "src/**"');
+  expect(pr).toContain("types: [opened, synchronize, reopened, ready_for_review]");
+  expect(header).toContain("  workflow_dispatch:");
+  for (const profile of ["all", "typescript", "actions"]) {
+    expect(header).toContain(`          - ${profile}`);
+  }
+  expect(header).toContain(
+    "group: codeql-${{ github.workflow }}-${{ github.event_name }}-" +
+      "${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event.pull_request.number || github.ref }}",
+  );
+  expect(header).toContain("cancel-in-progress: ${{ github.event_name == 'pull_request' }}");
+});

From 1787bcdc9f8ce69f2f47198631cfe7871c9996b9 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Tue, 3 Nov 2026 20:27:57 +0800
Subject: [PATCH 2/2] test(ci): keep workflow header extraction type-safe

---
 src/ci-workflow.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ci-workflow.test.ts b/src/ci-workflow.test.ts
index 440c4f1..2a278da 100644
--- a/src/ci-workflow.test.ts
+++ b/src/ci-workflow.test.ts
@@ -3,7 +3,7 @@ import { expect, it } from "vitest";
 
 it("preserves weekly CodeQL and admits checkout-attribute PR changes", async () => {
   const workflow = await readFile(".github/workflows/codeql.yml", "utf8");
-  const header = workflow.split("\njobs:\n", 1)[0];
+  const header = workflow.slice(0, workflow.indexOf("\njobs:\n"));
   const pr = header.split("  pull_request:\n")[1]?.split("  schedule:\n")[0];
 
   expect(header).not.toMatch(/^  push:/mu);