From b0e1c83f15b2de1918de11468e8b6c68b87547a3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 11:30:00 +0900 Subject: [PATCH 1/2] fix(ci): retire duplicate PR-triggered CodeQL scan The org's central required-workflow ruleset (CWL Central required workflows, id 18156473) already requires .github/workflows/codeql-pr.yml from ContextualWisdomLab/.github on every PR to this repo, uploading merge-preview SARIF on the real merge commit. This repo's own codeql.yml also triggered on every pull_request with no filter, so every PR push ran CodeQL twice -- once centrally (the one that actually gates merge) and once locally (redundant, and competing for the same GitHub-hosted runner admission the org is currently starved for). Keeps push/schedule triggers for branch-history scanning, which the central PR-only gate does not cover. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/codeql.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 176559fb..fccb3fd7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -3,9 +3,19 @@ name: codeql on: push: branches: [main, develop] - pull_request: schedule: - cron: '43 5 * * 1' + # Deliberately no pull_request trigger: ContextualWisdomLab organization + # ruleset "CWL Central required workflows" (id 18156473) already requires + # the central .github/workflows/codeql-pr.yml on every PR to this repo's + # inherited branches, uploading merge-preview SARIF on the real merge + # commit SHA. Keeping a repository-local pull_request trigger here would + # duplicate that scan on every push and consume runner admission twice + # for the same PR head, without adding coverage -- see + # ContextualWisdomLab/.github's docs/org-required-workflow-rollout.md + # "Code scanning required workflow posture" section. This workflow stays + # for push/schedule branch-history scanning, which the central PR gate + # does not cover. permissions: actions: read From 31cb91d750a37bb091d55262dc574d41351fe6c9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 13:45:01 +0900 Subject: [PATCH 2/2] fix(ci): restore PR CodeQL until central branch scope is complete --- .github/workflows/codeql.yml | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fccb3fd7..176559fb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -3,19 +3,9 @@ name: codeql on: push: branches: [main, develop] + pull_request: schedule: - cron: '43 5 * * 1' - # Deliberately no pull_request trigger: ContextualWisdomLab organization - # ruleset "CWL Central required workflows" (id 18156473) already requires - # the central .github/workflows/codeql-pr.yml on every PR to this repo's - # inherited branches, uploading merge-preview SARIF on the real merge - # commit SHA. Keeping a repository-local pull_request trigger here would - # duplicate that scan on every push and consume runner admission twice - # for the same PR head, without adding coverage -- see - # ContextualWisdomLab/.github's docs/org-required-workflow-rollout.md - # "Code scanning required workflow posture" section. This workflow stays - # for push/schedule branch-history scanning, which the central PR gate - # does not cover. permissions: actions: read