From e87425282957ecaa28bd81696aa7b0e403ccd699 Mon Sep 17 00:00:00 2001 From: Micah Villmow <4211002+mvillmow@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:15:28 -0700 Subject: [PATCH 1/2] ci(workflows): extract CodeQL analysis into dedicated workflow Move the CodeQL job out of _required.yml into a new codeql.yml workflow and update the workflows README accordingly. Closes #655 Implemented-By: OpenCode Co-Authored-By: OpenCode-AI <4211002+mvillmow@users.noreply.github.com> Signed-off-by: Micah Villmow <4211002+mvillmow@users.noreply.github.com> --- .github/workflows/README.md | 3 ++ .github/workflows/_required.yml | 68 ------------------------ .github/workflows/codeql.yml | 92 +++++++++++++++++++++++++++++++++ 3 files changed, 95 insertions(+), 68 deletions(-) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 2b23c2ea..d1a8e5d3 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -9,6 +9,9 @@ security scanning of the Keystone HMAS (Hierarchical Multi-Agent System) codebas - **`_required.yml`** emits the baseline required contexts, including lint, build, test, package, security, schema, and dependency-version checks. +- **`codeql.yml`** is the fleet-standard CodeQL analysis workflow for C++ and + Python (weekly schedule); it replaces the `analyze` job formerly in + `_required.yml` (#655). - **`extras.yml`** emits the separately required `coverage` context and advisory benchmark/NATS checks. - **`release-please.yml`** manages releases after pushes to `main`. diff --git a/.github/workflows/_required.yml b/.github/workflows/_required.yml index c8366c1a..92b9d224 100644 --- a/.github/workflows/_required.yml +++ b/.github/workflows/_required.yml @@ -996,71 +996,3 @@ jobs: fail_ci_if_error: false env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - - # ============================================================ - # 22. analyze (restored CodeQL, see commit 79e8e0e) - # The consolidation deleted codeql-analysis.yml but never added the - # Analyze job to this file, so C++ had no CodeQL coverage and the - # cpp/unused-* alerts from the old workflow could never auto-close. - # Restored from the deleted workflow (c-cpp manual build + python). - # ============================================================ - analyze: - name: Analyze (${{ matrix.language }}) - runs-on: ubuntu-24.04 - timeout-minutes: 60 - permissions: - contents: read - security-events: write - actions: read - - strategy: - fail-fast: false - matrix: - include: - - language: c-cpp - build-mode: manual - - language: python - build-mode: none - - steps: - - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - name: Initialize CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - queries: security-and-quality - config-file: ./.github/codeql/codeql-config.yml - - # C++ manual build steps -- only run for c-cpp - - name: Install build dependencies - if: matrix.language == 'c-cpp' - uses: ./.github/actions/install-build-deps - with: - cache-conan: "true" - - - name: Cache FetchContent downloads - if: matrix.language == 'c-cpp' - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: build/codeql/_deps - key: fetchcontent-codeql-${{ runner.os }}-${{ hashFiles('CMakeLists.txt') }} - restore-keys: | - fetchcontent-codeql-${{ runner.os }}- - - - name: Install Conan dependencies - if: matrix.language == 'c-cpp' - run: conan install . --output-folder=build/codeql/conan-deps --build=missing -s build_type=Release -s compiler.cppstd=20 - - - name: Build for CodeQL analysis - if: matrix.language == 'c-cpp' - run: | - cmake -S . -B build/codeql -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=build/codeql/conan-deps/conan_toolchain.cmake - cmake --build build/codeql - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 - with: - category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..978ea7e8 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,92 @@ +# Fleet-standard CodeQL analysis for Keystone (C++ + Python). +# +# Restores a committed, dedicated CodeQL workflow per HomericIntelligence/Keystone#655: +# the GitHub-managed dynamic workflow had degraded to python-only analysis, leaving +# C++ uncovered. The proven manual-build `analyze` job from `_required.yml` +# (restored by #657) moves here — mirroring the fleet-standard shape from the +# HomericIntelligence/Odysseus#455 rollout — so CodeQL runs once with no duplicate +# SARIF uploads under the same /language:* categories. +# +# The C++ build uses the Conan toolchain explicitly (autobuild cannot pass +# -DCMAKE_TOOLCHAIN_FILE), and vendored dependencies under build/**/_deps/ are +# excluded from analysis via .github/codeql/codeql-config.yml (#614). + +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: "0 8 * * 1" + workflow_dispatch: + +permissions: + contents: read + security-events: write + actions: read + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-24.04 + timeout-minutes: 60 + + strategy: + fail-fast: false + matrix: + include: + - language: c-cpp + build-mode: manual + - language: python + build-mode: none + + steps: + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + - name: Initialize CodeQL + uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + queries: security-and-quality + config-file: ./.github/codeql/codeql-config.yml + + # C++ manual build steps -- only run for c-cpp + - name: Install build dependencies + if: matrix.language == 'c-cpp' + uses: ./.github/actions/install-build-deps + with: + cache-conan: "true" + + - name: Cache FetchContent downloads + if: matrix.language == 'c-cpp' + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: build/codeql/_deps + key: fetchcontent-codeql-${{ runner.os }}-${{ hashFiles('CMakeLists.txt') }} + restore-keys: | + fetchcontent-codeql-${{ runner.os }}- + + - name: Install Conan dependencies + if: matrix.language == 'c-cpp' + run: conan install . --output-folder=build/codeql/conan-deps --build=missing -s build_type=Release -s compiler.cppstd=20 + + - name: Build for CodeQL analysis + if: matrix.language == 'c-cpp' + run: | + cmake -S . -B build/codeql -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=build/codeql/conan-deps/conan_toolchain.cmake + cmake --build build/codeql + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 + with: + category: "/language:${{ matrix.language }}" From 6f4d422bb6ea9e5e0c7dc335f1a180305105883f Mon Sep 17 00:00:00 2001 From: Micah Villmow <4211002+mvillmow@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:27 -0700 Subject: [PATCH 2/2] feat: Implement #655 fix(automation): request valid gh pr checks --json fields Closes #655 Implemented-By: OpenCode Co-Authored-By: OpenCode-AI <4211002+mvillmow@users.noreply.github.com> Signed-off-by: Micah Villmow <4211002+mvillmow@users.noreply.github.com> --- .github/workflows/codeql.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 978ea7e8..922254e3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,6 +10,14 @@ # The C++ build uses the Conan toolchain explicitly (autobuild cannot pass # -DCMAKE_TOOLCHAIN_FILE), and vendored dependencies under build/**/_deps/ are # excluded from analysis via .github/codeql/codeql-config.yml (#614). +# +# Pinned-contexts safety: verified via `gh api repos/HomericIntelligence/Keystone/rulesets?includes_parents=true` +# that neither `Analyze (c-cpp)` nor `Analyze (python)` is a required_status_check — +# ruleset 15556488 (`homeric-main-baseline`) pins lint, unit-tests, integration-tests, +# security/dependency-scan, security/secrets-scan, build, schema-validation, +# deps/version-sync, test, package, release, install; ruleset 18221122 +# (`homeric-main-extras`) pins coverage only. Moving this job out of `_required.yml` +# therefore cannot brick the merge queue. name: CodeQL