fix(security): keep every CodeQL Action phase on one revision

[seonghobae]

Problem

Dependabot opens CodeQL init, autobuild, analyze, and upload-sarif updates independently. Merging them separately creates an unreviewed mixed CodeQL lifecycle. This branch is the canonical BandScope owner for keeping every checked-in CodeQL Action phase on one reviewed immutable revision.

Exact current identity

• Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Branch: fix/codeql-action-consistency-v4-37-6.
• Exact current head: b860c4960083d3abf0ffe2682b2a75f0418f42c0.
• Open, Draft, mergeable, unmerged at the latest refetch.

Exactly six files differ from protected develop: the three CodeQL/SARIF workflow files, CHANGELOG.md, the CodeQL doctoring note, and the permanent Python contract test. There is no application dependency or root lockfile diff.

Atomic v4.37.8 update

The branch now pins every checked-in github/codeql-action/init, autobuild, analyze, and upload-sarif reference to CodeQL Action v4.37.8 target commit db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 and updates the matching version annotations.

Fresh upstream verification on 2026-08-26 KST resolved refs/tags/v4.37.8 to annotated tag object 37f2634a92ba38a0926ef79a0748ac8ae7d95ab2, whose target is commit db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28. The tag object is unsigned, so the security claim remains intentionally narrow: workflows execute the reviewed immutable commit SHA; no signed-tag claim is made. The v4.37.8 release reports no user-facing changes and retains the CodeQL bundle line introduced by v4.37.7.

Workflow triggers, permissions, language selection, build behavior, SARIF paths, application dependencies, database, network authority, filesystem authority, model, and IPC surfaces are unchanged.

Regression contract / update order

The permanent guard in services/analysis-engine/tests/test_codeql_action_revision_contract.py scans every checked-in CodeQL Action reference, including malformed or mutable refs, and requires one reviewed exact SHA plus the matching version annotation.

For this update the expected SHA/version was changed first in commit c43bf95bc0cb0fff952c3ef46bcb15c31fd4bed5, making the old v4.37.7 workflow state a deterministic RED candidate. The workflow phases were then advanced on the same canonical branch, followed by doctoring and CHANGELOG. Hosted RED is not claimed unless a terminal run against that intermediate head is available; the test-first source order is the evidence currently available.

Split Dependabot ownership

The fresh v4.37.8 split PRs #1026 (init), #1028 (analyze), #1029 (autobuild), and #1030 (upload-sarif) are dependency fragments of this atomic lifecycle and are not independently merge-ready authority. Do not copy predecessor checks or approvals from those PRs into this branch. Close them only after this coordinated exact head is proven semantically superseding and accepted under the protected merge gate.

Historical split sets (#764/#766/#767/#768 and #924/#930/#932/#933) remain predecessor evidence only.

Dependency / review boundaries

• Canonical fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 owns the protected-base JavaScript dependency-security baseline; this PR must not suppress or duplicate it.
• Central .github workflows are read-only control-plane authority from this BandScope writer.
• No self/author/model-only review is a qualifying independent approval.

Exact-head verification

All workflow evidence from head 738495ca9d425fb34a12e76c0614eda356e68f3a and earlier is predecessor evidence after the v4.37.8 commits. Fresh repository and central workflows for exact current head b860c4960083d3abf0ffe2682b2a75f0418f42c0 must be terminal-success before readiness can be claimed. Queued, pending, skipped-required, cancelled, failed, stale, predecessor-head, protected-base, self/author, model-only, or administrative-bypass evidence is non-passing.

Merge gate

Keep Draft and unmerged until this unchanged exact head has the focused CodeQL revision contract GREEN, complete repository CI/build/release/SAST/security/SBOM/supply-chain/package evidence terminal-success, exact required owned statement/branch coverage and docstrings, fresh central OpenCode/Noema/Strix/coverage evidence, zero valid unresolved findings, a qualifying independent non-author last-push approval, and ordinary branch-protection acceptance without bypass. Never force-push, self-approve, weaken a gate, or merge one CodeQL phase independently.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

/oc Refetch the live pull request and abort without writing unless its exact head is 7c9343aede26a44239b12c805fdd0ab0b1398dba on branch fix/codeql-action-consistency-v4-37-6. Exact-head CI run 31170110007, job 92839810936, is the authoritative RED evidence: the Rust/Tauri gate passed; quickcheck reached Ruff after all documentation, security-pattern, supply-chain, bootstrap, frontend workspace lint, and docstring gates passed; the only quality failure is I001 for the import block in services/analysis-engine/tests/test_codeql_action_revision_contract.py. Apply the formatter-derived minimum repair only: from services/analysis-engine, run the repository-pinned uv run ruff check tests/test_codeql_action_revision_contract.py --select I --fix, inspect the diff, and commit only Ruff's canonical import-block ordering. Do not hand-guess another style, change the test behavior, CodeQL SHA/version contract, workflows, dependencies, lockfiles, doctoring, release metadata, or unrelated files. Run the focused Ruff check and the two CodeQL contract tests first, then the complete exact-head quickcheck, CI, Rust/Tauri, package/release, SBOM, Security Scan, SAST, and git diff --check. The known two high-severity JavaScript findings belong to atomic baseline PR #783 and must not be papered over here. Do not create another branch, PR, one-shot/self-modifying workflow, patch artifact, or encoded patch. Keep Draft until the new exact head is fully green, current-head actionable threads are zero, #783 has established the protected dependency baseline or this branch is rebased onto it, and a qualifying independent non-author approval exists.

[seonghobae]

Exact-head triage at 0a6ae2b4d749d473f3b0a451bed1a6a58c876080: CI/build/release/SBOM/Bandit/secret/Semgrep are green, but security-audit and Security Scan fail because this branch still inherits the protected-base npm findings for nanoid <3.3.18, pdfjs-dist <6.2.108, and undici <=7.28.0. Those are being remediated atomically by #783; duplicating that package/lockfile work here would create conflicting supply-chain ownership. Keep #780 blocked on #783 rather than copying its fix. After #783 lands, rebase/refresh #780 on the new develop, then require exact-new-head security and review evidence before Ready/merge.

[seonghobae]

@opencode-agent Review the exact current head 0a6ae2b4d749d473f3b0a451bed1a6a58c876080 against protected develop and submit a formal current-head decision. I re-verified upstream github/codeql-action annotated tag v4.37.6: it dereferences to commit 5595ccaf912efad79be6eef63a5619ff05969be3, matching every CodeQL phase and SARIF uploader in this PR. Do not reuse predecessor-head review evidence.

[opencode-agent]

Queued @opencode-agent for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

@opencode-agent Repair the exact current-head Ruff formatter blocker on the existing fix/codeql-action-consistency-v4-37-6 branch only. Refetched immediately before dispatch: protected base develop@acdbea6344fe1231c39535b575f4de35e4c607c9, exact head b860c4960083d3abf0ffe2682b2a75f0418f42c0, CI run 32883014036, failing job 97916784675, actual merge checkout 316215ab8421f8d3b5af31f60af8b63b9f24b1bc. The exact job log proves docs/security/supply-chain/bootstrap/workspace lint/Python docstrings/Ruff lint all pass; the first and only quickcheck boundary is repository-pinned Ruff 0.15.5 format --check saying tests/test_codeql_action_revision_contract.py would be reformatted. Apply only the output of uv run --directory services/analysis-engine ruff format tests/test_codeql_action_revision_contract.py; inspect and commit only that formatter-derived diff. Do not change the CodeQL SHA/version contract, workflows, dependencies/lockfiles, doctoring, release metadata, or unrelated files. Verify focused ruff check + ruff format --check for that file, its CodeQL revision contract tests, then canonical quickcheck. Re-fetch exact successor head/base before claiming success. Do not resolve unrelated threads or change Draft state.

[seonghobae]

/oc Refetch PR #780 and abort without writing unless the live branch is fix/codeql-action-consistency-v4-37-6 at exact head d9b8e97fa00f2e0e34e15654a3d5ffa6e34ab75b against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9. Treat prior heads and the earlier manual formatting attempt as predecessor evidence.

Systematic-debugging evidence for this exact head:

• release run 32890724510, release-preflight job 97941778564;
• actual merge checkout 78713d869dcc61c332b7defedb55aa8887ad8f39;
• checkout/setup/npm/uv sync, documentation, Security Notes, security-pattern, supply-chain, GitHub-bootstrap, workspace ESLint, Python docstrings, and uv run ruff check src tests all pass;
• first BandScope-owned failure is repository-pinned Ruff 0.15.5 format --check: exactly tests/test_codeql_action_revision_contract.py still reports Would reformat (87 files already formatted).

The hand-edited layout on d9b8e97… therefore falsified the manual-formatting hypothesis. Use the formatter as the authority instead of guessing another layout: from services/analysis-engine, run the repository-pinned uv run ruff format tests/test_codeql_action_revision_contract.py, inspect its exact diff, and commit only that formatter-produced change to the existing canonical branch. Do not change test semantics, expected CodeQL v4.37.8 SHA/version, workflows, dependencies, lockfiles, doctoring, release metadata, or any unrelated path.

Verification acceptance on the successor exact head: focused uv run ruff format --check tests/test_codeql_action_revision_contract.py, focused CodeQL revision-contract tests, then canonical ./scripts/harness/quickcheck.sh; refetch the new head/base and exact workflow checkout before claiming GREEN. Do not weaken a gate or paper over inherited dependency findings; #783 remains the dependency-security owner. Keep Draft/unmerged and do not self-approve.

[seonghobae]

@opencode-agent Repair only the current exact-head formatter blocker on the existing fix/codeql-action-consistency-v4-37-6 branch. Writer lease refetch immediately before any write: PR #780 must still be open Draft/unmerged at head d9b8e97fa00f2e0e34e15654a3d5ffa6e34ab75b against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9, and services/analysis-engine/tests/test_codeql_action_revision_contract.py must still be blob 03d26b3696dfdb09ed85313d61159eadc2d1ae0c; otherwise inspect movement and adapt instead of overwriting it.

Authoritative current-head RED evidence is CI run 32890724662, job 97941779134, actual checkout 78713d869dcc61c332b7defedb55aa8887ad8f39. Setup, npm/uv sync, Rust extension build, docs, security notes/patterns, supply-chain, GitHub bootstrap, workspace ESLint, Python docstrings, and Ruff lint all pass. The first and only quickcheck failure is repository-pinned Ruff 0.15.5 format --check, which reports exactly tests/test_codeql_action_revision_contract.py would be reformatted. gate / ci / rust-check job 97941779484 is independently successful.

Run the repository-pinned formatter (uv run --directory services/analysis-engine ruff format tests/test_codeql_action_revision_contract.py or the repository-equivalent pinned command), inspect its generated diff, and commit only that formatter-derived change. Do not hand-style, alter the CodeQL v4.37.8 SHA/version contract, workflows, CHANGELOG/doctoring, dependencies/lockfiles, security baseline, or unrelated files. Then run focused Ruff check/format plus the CodeQL revision contract tests and canonical ./scripts/harness/quickcheck.sh. Report the successor exact head and terminal evidence. Keep the PR Draft; do not merge, self-approve, or close the split Dependabot PRs yet. #783 owns inherited npm dependency security.