docs(ci): align intended CodeQL contexts with central owner

[seonghobae]

Repository-source half of #1172, now stacked on the live canonical prerequisite #1177.

Stack and ownership

• Protected/default product authority remains develop@314ddeae7b775a4957594b599358c8255617eb2e.
• Canonical prerequisite fix(security): restore canonical CSV control-prefix boundary #1177 exact head is 607957e24a3b1c32a5b4faddb551145c6460e301.
• This PR exact head is 0ac829977615305775fa3b48fc630ca5b43ca85d.
• Two-parent reconciliation 0ac8299… preserves the prior docs(ci): align intended CodeQL contexts with central owner #1183 history as first parent and records fix(security): restore canonical CSV control-prefix boundary #1177 as second parent. Its tree is fix(security): restore canonical CSV control-prefix boundary #1177 plus exactly docs/security/github-required-checks.md; no force update or source duplication was used.
• Base is the fix(security): restore canonical CSV control-prefix boundary #1177 branch, so the dependency remains explicit and protected-branch workflows will be regenerated after fix(security): restore canonical CSV control-prefix boundary #1177 lands and this PR is retargeted to fresh develop.

Repair

Protected develop still requires retired classic contexts Analyze (javascript-typescript) and Analyze (python), while the repository CodeQL workflow that emitted those names was removed in #1165 and the central producer uses CodeQL compatibility analysis (<language>).

This Draft changes only docs/security/github-required-checks.md to describe the intended central compatibility contexts. It explicitly records that live protected settings remain stale; the document is not shipped truth until the admin-side mutation and unchanged-head evidence complete.

The central verdict path is separately unhealthy. #1177 run 34064666814 dispatched python, javascript-typescript, and actions shards successfully but remained verdict=pending without the promised exact-job rerun. ContextualWisdomLab/.github#1902 is the canonical rerun-recovery owner; this PR neither duplicates nor bypasses it.

Security and merge gate

No runtime input, API, workflow, SQL, or product behavior changes. Preserve CodeQL as a required gate; do not restore duplicate scanning, synthesize statuses, or weaken protection.

Keep Draft until #1177 lands, live branch protection is updated, this PR is retargeted to fresh protected develop, and fresh exact-head checks plus independent review complete.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact head c00ac7f4a6e5a406cdacfd9e6d0813eb4e17a2ec as the repository-source half of #1172. Verify that the document names the actual central CodeQL compatibility contexts, does not weaken the CodeQL gate, does not imply a duplicate repository-local scanner, and makes the admin-side branch-protection mutation an explicit prerequisite rather than claiming the live settings are already repaired.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

expected_head='c00ac7f4a6e5a406cdacfd9e6d0813eb4e17a2ec'
echo '== Checked-out revision =='
git rev-parse HEAD
git status --short
git show --no-ext-diff --format=fuller --stat "$expected_head"
echo '== Diff from develop merge-base =='
base="$(git merge-base "$expected_head" develop)"
git diff --no-ext-diff --unified=80 "$base" "$expected_head" -- docs/security/github-required-checks.md

echo '== Documentation structure =='
ast-grep outline docs/security/github-required-checks.md --items all || true
echo '== Relevant document terms =='
rg -n -i -C 4 'CodeQL|compatibility|central|repository.local|branch.protection|required.context|Draft|admin|retired|Analyze \(' docs/security/github-required-checks.md

echo '== Repository CodeQL configuration files =='
fd -HI -t f .github | sort
echo '== CodeQL workflow references =='
rg -n -i -C 3 'codeql|github/codeql-action|CodeQL compatibility analysis|Analyze \(javascript-typescript\)|Analyze \(python\)' .github README.md docs 2>/dev/null || true

echo '== Pull request and exact-head check runs =='
gh pr view 1183 --repo ContextualWisdomLab/bandscope --json number,state,isDraft,headRefOid,baseRefName,url,title
gh api "repos/ContextualWisdomLab/bandscope/commits/${expected_head}/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, .conclusion, .app.name] | `@tsv`' | sort || true

echo '== Current develop branch protection =='
gh api 'repos/ContextualWisdomLab/bandscope/branches/develop/protection/required_status_checks' \
  --jq '{strict, contexts, checks}' || true

Length of output: 31488

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/bandscope'
sha='c00ac7f4a6e5a406cdacfd9e6d0813eb4e17a2ec'

echo '== Issue `#1172` =='
gh issue view 1172 --repo "$repo" --comments

echo '== Workflow runs for the exact head =='
gh api "repos/${repo}/actions/runs?head_sha=${sha}&per_page=100" \
  --jq '.workflow_runs[] | [.id, .name, .event, .status, .conclusion, .html_url] | `@tsv`' | sort

echo '== Exact-head check runs, refreshed =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, (.conclusion // ""), .html_url] | `@tsv`' | sort

echo '== Exact CodeQL-context matches =='
gh api "repos/${repo}/commits/${sha}/check-runs?per_page=100" \
  --jq '[.check_runs[] | select(.name == "CodeQL compatibility analysis (javascript-typescript)" or .name == "CodeQL compatibility analysis (python)" or .name == "Analyze (javascript-typescript)" or .name == "Analyze (python)") | {name,status,conclusion,details_url:.details_url}]'

echo '== PR mergeability and review decision =='
gh pr view 1183 --repo "$repo" \
  --json isDraft,mergeStateStatus,reviewDecision,statusCheckRollup,updatedAt \
  --jq '{isDraft, mergeStateStatus, reviewDecision, updatedAt, statusCheckRollup: [.statusCheckRollup[] | {name: .name, status: .status, conclusion: .conclusion}]}'

Length of output: 13957

---

@seonghobae Reviewed exact head c00ac7f4a6e5a406cdacfd9e6d0813eb4e17a2ec.

No source-level findings.

The document names the two context names specified by #1172:

• CodeQL compatibility analysis (javascript-typescript)
• CodeQL compatibility analysis (python)

The document keeps both CodeQL contexts as required checks for develop and main. It identifies the central required workflow as the PR owner. It also states that GitHub CodeQL/default setup remains the scanner authority. It does not request or imply a second repository-local CodeQL PR workflow.

The document explicitly states that develop still requires the retired Analyze (...) contexts. It requires the admin-side branch-protection mutation and unchanged-head terminal evidence before merge. This prevents the document from representing the live configuration as repaired.

The exact head currently has terminal retired Analyze (...) checks. The central CodeQL PR workflow is still queued. The replacement compatibility contexts are therefore not yet terminal on this head. This matches the document's merge gate.

The integration could not independently re-read branch protection because GitHub returned HTTP 403. The document does not depend on that unavailable read to claim that the migration is complete.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please review the new exact stacked head c0db8829873b0bff8efa25371dc4ee76bf6ff3a5. #1176 is now an ordinary second-parent foundation; compare from #1176 exact a7b0030a3a6cc6296a19ba3f8eaf595d470d05bd leaves exactly one semantic file, docs/security/github-required-checks.md. Verify the document-only CodeQL context migration contract and flag any gate weakening, ownership ambiguity, or claim that the live admin setting is already repaired.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/bandscope'
head='c0db8829873b0bff8efa25371dc4ee76bf6ff3a5'
foundation='a7b0030a3a6cc6296a19ba3f8eaf595d470d05bd'

echo '== Exact revisions and ancestry =='
git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git cat-file -e "${foundation}^{commit}"
git merge-base --is-ancestor "$foundation" "$head" && echo 'foundation_is_ancestor=true'
git rev-list --parents -n 1 "$head"
git diff --name-status "$foundation" "$head"
echo '== Focused documentation diff =='
git diff --no-ext-diff --unified=100 "$foundation" "$head" -- docs/security/github-required-checks.md

echo '== Documentation outline and relevant content =='
ast-grep outline docs/security/github-required-checks.md --items all || true
rg -n -i -C 5 'CodeQL|compatibility analysis|Analyze \(|central|default setup|repository-local|scanner|branch protection|required|admin|live|draft|merge' docs/security/github-required-checks.md

echo '== Repository workflow and configuration evidence =='
fd -HI -t f .github | sort
rg -n -i -C 4 'CodeQL|github/codeql-action|compatibility analysis|Analyze \(javascript-typescript\)|Analyze \(python\)' .github docs README.md 2>/dev/null || true

echo '== Pull request and exact-head checks =='
gh pr view 1183 --repo "$repo" --json number,state,isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,url
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
  --jq '.check_runs[] | [.name, .status, (.conclusion // ""), .app.name] | `@tsv`' | sort
echo '== Matching migration contexts =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
  --jq '[.check_runs[] | select(.name == "CodeQL compatibility analysis (javascript-typescript)" or .name == "CodeQL compatibility analysis (python)" or .name == "Analyze (javascript-typescript)" or .name == "Analyze (python)") | {name,status,conclusion,app:.app.name,details_url}]'

echo '== Live develop branch-protection required checks =='
gh api "repos/${repo}/branches/develop/protection/required_status_checks" \
  --jq '{strict,contexts,checks}'

Length of output: 34974

---

🏁 Script executed:

#!/bin/bash
set -u -o pipefail

repo='ContextualWisdomLab/bandscope'
head='c0db8829873b0bff8efa25371dc4ee76bf6ff3a5'

run() {
  echo
  echo "== $1 =="
  shift
  "$@"
  rc=$?
  echo "[exit=${rc}]"
  return 0
}

run 'PR status-check rollup' \
  gh pr view 1183 --repo "$repo" \
  --json isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,statusCheckRollup,updatedAt \
  --jq '{isDraft,headRefOid,baseRefName,mergeStateStatus,reviewDecision,updatedAt,statusCheckRollup:[.statusCheckRollup[] | {name,status,conclusion,workflowName,detailsUrl}]}'

run 'Workflow runs for exact head' \
  gh api "repos/${repo}/actions/runs?head_sha=${head}&per_page=100" \
  --jq '.workflow_runs[] | {id,name,event,status,conclusion,created_at,updated_at,html_url}'

run 'Check suites for exact head' \
  gh api "repos/${repo}/commits/${head}/check-suites?per_page=100" \
  --jq '.check_suites[] | {app:.app.name,status,conclusion,head_branch,head_sha,url}'

run 'Check runs for exact head' \
  gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
  --jq '.check_runs[] | {name,status,conclusion,app:.app.name,details_url,started_at,completed_at}'

run 'Legacy commit statuses for exact head' \
  gh api "repos/${repo}/commits/${head}/status" \
  --jq '{state,contexts:[.statuses[] | {context,state,description,target_url,updated_at}]}'

Length of output: 3814

---

@seonghobae Reviewed exact head c0db8829873b0bff8efa25371dc4ee76bf6ff3a5.

No source-level findings.

The stated foundation commit is an ancestor of this head. The compare changes only docs/security/github-required-checks.md.

The document keeps two required CodeQL contexts on both develop and main:

• CodeQL compatibility analysis (javascript-typescript)
• CodeQL compatibility analysis (python)

The document does not weaken the CodeQL gate. It replaces only the retired Analyze (...) context names.

The ownership statement is clear. The organization required-workflow rule owns the PR compatibility contexts. GitHub CodeQL/default setup remains the scanner authority. The document explicitly rejects a second repository-local CodeQL PR workflow.

The document does not claim that the live setting is repaired. It states that develop still requires the retired contexts. It requires a repository-admin branch-protection change and terminal replacement-context results on an unchanged PR head before merge.

The integration could not read live develop branch protection because GitHub returned HTTP 403. The exact head also has no GitHub Actions workflow run or CodeQL check run yet. Therefore, terminal producer evidence cannot yet independently confirm the emitted central context names. The document correctly treats that evidence as a prerequisite rather than as completed work.

You are interacting with an AI system.