[Netscale1]

Summary

• add an advanced CodeQL workflow for the fast actions, csharp, and python analyses
• move c-cpp and swift to a macOS-scoped workflow
• skip the macOS-scoped workflow on pull requests that only change Windows files
• keep macOS CodeQL on every push to main, on a weekly schedule, and on manual dispatch
• preserve the current default-setup build modes and analysis categories

Why

Five recent CodeQL runs show Swift taking 16m47s to 21m48s in total, with 15m20s to 19m51s spent in autobuild. Every other language completed in at most 2m08s. PR #15 changes only Windows source, but default setup still launched the Swift job.

The macOS path filter includes all macOS source plus the macOS build scripts and GitHub workflows that can change how the macOS code is built or analyzed. A Windows-only pull request still runs CodeQL for Actions, C#, and Python. The next push to main and the weekly schedule still scan all five languages.

Validation

• confirmed the live default setup scans actions, c-cpp, csharp, python, and swift with the default query suite and weekly schedule
• reproduced its build modes: none for the four fast analyses and autobuild for Swift
• pinned github/codeql-action v4.37.7 and reused the repository's pinned checkout action
• parsed both workflow files as YAML and passed git diff --check
• verified the filter selects macOS PR Fix virtual microphone sample rate and buffer races #14 and does not select Windows-only PR Wake reconnect when the Mac becomes available #15
• confirmed branch protection currently requires only the existing macos and windows CI checks

Safe activation after merge

Default setup remains enabled intentionally. GitHub blocks advanced CodeQL uploads while default setup is active, so it must not be disabled before this workflow exists on main. The advanced jobs in this draft therefore initialize and analyze normally, then report the expected upload rejection; this is the migration interlock, not a workflow syntax or build failure.

After merge:

1. Wait for the default-setup CodeQL scan of the merged main commit to finish successfully.
2. Disable CodeQL default setup.
3. Manually dispatch both CodeQL and CodeQL macOS from main.
4. Verify successful uploads for all five language categories before considering the migration complete.

This sequence keeps the latest main commit covered throughout the migration.