fix(ci): avoid duplicate main-push CodeQL scans

.ci-policy.md

@@ -0,0 +1 @@
+CodeQL keeps its full weekly Monday 07:23 UTC scan instead of scanning each main push because this repository is quiet; PR and manual profile scans remain available, and ordinary CI, deployment, and release workflows are unchanged.

.github/workflows/codeql.yml

@@ -12,19 +12,11 @@ on:
           - all
           - typescript
           - actions
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/codeql/**"
-      - ".github/workflows/**"
-      - "src/**"
-      - "package.json"
-      - "pnpm-lock.yaml"
-      - "tsconfig*.json"
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
     paths:
+      - ".gitattributes"
+      - "**/.gitattributes"
       - ".github/codeql/**"
       - ".github/workflows/**"
       - "src/**"
@@ -35,7 +27,7 @@ on:
     - cron: "23 7 * * 1"
 
 concurrency:
-  group: codeql-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event_name == 'pull_request' && github.event.pull_request.number || github.sha }}
+  group: codeql-${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## 0.8.5 - Unreleased
 
+- Keep full weekly CodeQL analysis without duplicate main-push scans, isolate scheduled and manual runs, and scan PRs that change checkout attributes.
+
 - Avoid duplicate CI compilation by retaining the package smoke test's clean prepack build.
 - Refresh Oxfmt, test tooling, CodeQL, and TruffleHog within the 48-hour dependency policy while preserving Node 22 support. Thanks @dependabot! #249 #250
 

src/ci-workflow.test.ts

@@ -0,0 +1,24 @@
+import { readFile } from "node:fs/promises";
+import { expect, it } from "vitest";
+
+it("preserves weekly CodeQL and admits checkout-attribute PR changes", async () => {
+  const workflow = await readFile(".github/workflows/codeql.yml", "utf8");
+  const header = workflow.slice(0, workflow.indexOf("\njobs:\n"));
+  const pr = header.split("  pull_request:\n")[1]?.split("  schedule:\n")[0];
+
+  expect(header).not.toMatch(/^  push:/mu);
+  expect(header).toContain('cron: "23 7 * * 1"');
+  expect(pr).toContain('      - ".gitattributes"');
+  expect(pr).toContain('      - "**/.gitattributes"');
+  expect(pr).toContain('      - "src/**"');
+  expect(pr).toContain("types: [opened, synchronize, reopened, ready_for_review]");
+  expect(header).toContain("  workflow_dispatch:");
+  for (const profile of ["all", "typescript", "actions"]) {
+    expect(header).toContain(`          - ${profile}`);
+  }
+  expect(header).toContain(
+    "group: codeql-${{ github.workflow }}-${{ github.event_name }}-" +
+      "${{ github.event_name == 'workflow_dispatch' && github.run_id || github.event.pull_request.number || github.ref }}",
+  );
+  expect(header).toContain("cancel-in-progress: ${{ github.event_name == 'pull_request' }}");
+});