fix(security): keep every CodeQL Action phase on one revision

[seonghobae]

Outcome

Keep BandScope's checked-in CodeQL lifecycle under one canonical supply-chain owner instead of merging init, autobuild, analyze, and upload-sarif Dependabot fragments independently. This branch also absorbs the unique repository-control behavior that had accumulated in competing PR #1026: valid Dependabot CI/CD taxonomy and pull-request OpenSSF Scorecard evidence with trusted normalization code.

Fresh exact identity

• Protected base: develop@749511c3ad4000090048718f685c6bee6b3d2c25.
• Branch: fix/codeql-action-consistency-v4-37-6.
• Exact current head: 823a66200f7a9c846147d3632cc167c1c8f08c65.
• Direct comparison to protected develop: ahead_by=18, behind_by=0, merge base exactly 749511c3ad4000090048718f685c6bee6b3d2c25.
• Semantic delta is bounded to eight files: three CodeQL/SARIF workflows, .github/dependabot.yml, one doctoring note, and three executable regression contracts. Historical CHANGELOG.md churn was removed while reconciling to current protected truth.
• PR remains Draft because fresh exact-head hosted evidence is non-terminal and no qualifying independent non-author approval exists. There are currently zero inline review threads and zero submitted reviews.

Atomic v4.37.9 lifecycle

Every checked-in github/codeql-action/init, autobuild, analyze, and upload-sarif reference now uses immutable commit cdf488f595d80d6e07e03d4674febd5ab45fa938 with v4.37.9 annotation.

Fresh upstream resolution on 2026-09-02 found refs/tags/v4.37.9 -> annotated tag object a35ac6e6798d72df5475948b28efb89edc2e19ca -> commit cdf488f595d80d6e07e03d4674febd5ab45fa938. The tag is unsigned, so this PR makes no signed-tag claim. v4.37.9 advances the default CodeQL bundle to 2.26.4.

services/analysis-engine/tests/test_codeql_action_revision_contract.py scans every workflow for init|autobuild|analyze|upload-sarif, deliberately catches mutable/malformed refs, and requires the one exact reviewed SHA plus matching release annotation. codeql.yml additionally must keep init/autobuild/analyze atomic.

Transferred #1026 behavior

The competing lifecycle writer #1026 contained two non-version deltas that were not safe to discard. They are now preserved in this canonical branch:

• .github/dependabot.yml routes GitHub Actions updates to existing area: ci-cd plus dependencies; Dependabot had explicitly reported that configured label github-actions did not exist. test_dependabot_label_contract.py prevents regression.
• OpenSSF Scorecard now runs on ordinary pull requests to develop/main, while publish_results remains default-branch-only. The PR SARIF lane checks out repository-owned extraction/normalization scripts from github.event.pull_request.base.sha, never from the untrusted PR head, and does not use pull_request_target. test_scorecard_pr_code_scanning_contract.py pins that trust boundary.

#1026's narrower CodeQL version/uploader tests are semantically covered by the broader all-workflow revision contract here. Its unique routing and Scorecard behavior are explicitly covered by the two transferred contracts above. Predecessor checks, reviews, approvals, and statuses do not transfer.

TDD sequence

• RED e1ed1ced7ac77b36bab9abb744da39a232ecb154: ordinary-merges current protected develop into this lane and changes only executable contracts. Those contracts require v4.37.9, area: ci-cd, and PR Scorecard trust-boundary behavior while production config/workflows are still protected-base v4.37.0/old routing. This is deterministic source-order RED; no hosted RED is claimed unless a terminal run on that exact intermediate head exists.
• GREEN 823a66200f7a9c846147d3632cc167c1c8f08c65: updates only the owning config/workflows/doctoring required to satisfy those contracts.

Exact-head verification

Fresh workflows are materializing against exact head 823a66200f7a9c846147d3632cc167c1c8f08c65. At the latest refetch, required checks including scorecard, osv-scan, dependency-review, and trivy-fs are queued, therefore non-passing. All predecessor-head evidence is invalid for this head. There are no current review submissions or inline review threads; an independent non-author exact-head approval is still absent.

Split dependency ownership

Fresh v4.37.9 component PRs such as #1135 (autobuild), #1139 (upload-sarif), and #1141 (analyze) are dependency fragments, not independent lifecycle authority. Do not merge them separately or transfer their checks/reviews. Do not close those split PRs merely because this branch now contains their version delta: close them only after this coordinated lifecycle is accepted under the protected merge gate.

#783's JavaScript dependency-security baseline is already in protected develop ancestry, so stale text that treats #783 as pending is not a blocker here.

Security Notes

The change executes one reviewed immutable CodeQL Action revision across all phases and narrows PR Scorecard script authority to the protected base SHA. It adds no application filesystem, URL, model, database, IPC, credential, or runtime-network authority. Pull-request code-scanning upload capability still depends on GitHub token/repository policy; this PR does not fabricate success for forks or actors without the required permission.

Merge gate

Keep Draft and unmerged until this unchanged exact head has every applicable repository and central CI/security/SAST/SBOM/supply-chain/coverage/release check terminal-success, zero valid unresolved findings, a qualifying independent non-author last-push approval, and ordinary protected-branch acceptance. Queued, pending, skipped-required, cancelled, failed, neutral, stale, predecessor-head, protected-base, self/author, model-only, status-only, or administrative-bypass evidence is non-passing. Never force-push, self-approve, weaken a gate, or merge one CodeQL phase independently.

Relates to #966.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

/oc Refetch the live pull request and abort without writing unless its exact head is 7c9343aede26a44239b12c805fdd0ab0b1398dba on branch fix/codeql-action-consistency-v4-37-6. Exact-head CI run 31170110007, job 92839810936, is the authoritative RED evidence: the Rust/Tauri gate passed; quickcheck reached Ruff after all documentation, security-pattern, supply-chain, bootstrap, frontend workspace lint, and docstring gates passed; the only quality failure is I001 for the import block in services/analysis-engine/tests/test_codeql_action_revision_contract.py. Apply the formatter-derived minimum repair only: from services/analysis-engine, run the repository-pinned uv run ruff check tests/test_codeql_action_revision_contract.py --select I --fix, inspect the diff, and commit only Ruff's canonical import-block ordering. Do not hand-guess another style, change the test behavior, CodeQL SHA/version contract, workflows, dependencies, lockfiles, doctoring, release metadata, or unrelated files. Run the focused Ruff check and the two CodeQL contract tests first, then the complete exact-head quickcheck, CI, Rust/Tauri, package/release, SBOM, Security Scan, SAST, and git diff --check. The known two high-severity JavaScript findings belong to atomic baseline PR #783 and must not be papered over here. Do not create another branch, PR, one-shot/self-modifying workflow, patch artifact, or encoded patch. Keep Draft until the new exact head is fully green, current-head actionable threads are zero, #783 has established the protected dependency baseline or this branch is rebased onto it, and a qualifying independent non-author approval exists.

[seonghobae]

Exact-head triage at 0a6ae2b4d749d473f3b0a451bed1a6a58c876080: CI/build/release/SBOM/Bandit/secret/Semgrep are green, but security-audit and Security Scan fail because this branch still inherits the protected-base npm findings for nanoid <3.3.18, pdfjs-dist <6.2.108, and undici <=7.28.0. Those are being remediated atomically by #783; duplicating that package/lockfile work here would create conflicting supply-chain ownership. Keep #780 blocked on #783 rather than copying its fix. After #783 lands, rebase/refresh #780 on the new develop, then require exact-new-head security and review evidence before Ready/merge.

[seonghobae]

@opencode-agent Review the exact current head 0a6ae2b4d749d473f3b0a451bed1a6a58c876080 against protected develop and submit a formal current-head decision. I re-verified upstream github/codeql-action annotated tag v4.37.6: it dereferences to commit 5595ccaf912efad79be6eef63a5619ff05969be3, matching every CodeQL phase and SARIF uploader in this PR. Do not reuse predecessor-head review evidence.

[opencode-agent]

Queued @opencode-agent for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[opencode-agent]

Already queued @opencode-agent on this exact request for PR #780 at head 738495ca9d425fb34a12e76c0614eda356e68f3a. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

@opencode-agent Repair the exact current-head Ruff formatter blocker on the existing fix/codeql-action-consistency-v4-37-6 branch only. Refetched immediately before dispatch: protected base develop@acdbea6344fe1231c39535b575f4de35e4c607c9, exact head b860c4960083d3abf0ffe2682b2a75f0418f42c0, CI run 32883014036, failing job 97916784675, actual merge checkout 316215ab8421f8d3b5af31f60af8b63b9f24b1bc. The exact job log proves docs/security/supply-chain/bootstrap/workspace lint/Python docstrings/Ruff lint all pass; the first and only quickcheck boundary is repository-pinned Ruff 0.15.5 format --check saying tests/test_codeql_action_revision_contract.py would be reformatted. Apply only the output of uv run --directory services/analysis-engine ruff format tests/test_codeql_action_revision_contract.py; inspect and commit only that formatter-derived diff. Do not change the CodeQL SHA/version contract, workflows, dependencies/lockfiles, doctoring, release metadata, or unrelated files. Verify focused ruff check + ruff format --check for that file, its CodeQL revision contract tests, then canonical quickcheck. Re-fetch exact successor head/base before claiming success. Do not resolve unrelated threads or change Draft state.

[seonghobae]

/oc Refetch PR #780 and abort without writing unless the live branch is fix/codeql-action-consistency-v4-37-6 at exact head d9b8e97fa00f2e0e34e15654a3d5ffa6e34ab75b against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9. Treat prior heads and the earlier manual formatting attempt as predecessor evidence.

Systematic-debugging evidence for this exact head:

• release run 32890724510, release-preflight job 97941778564;
• actual merge checkout 78713d869dcc61c332b7defedb55aa8887ad8f39;
• checkout/setup/npm/uv sync, documentation, Security Notes, security-pattern, supply-chain, GitHub-bootstrap, workspace ESLint, Python docstrings, and uv run ruff check src tests all pass;
• first BandScope-owned failure is repository-pinned Ruff 0.15.5 format --check: exactly tests/test_codeql_action_revision_contract.py still reports Would reformat (87 files already formatted).

The hand-edited layout on d9b8e97… therefore falsified the manual-formatting hypothesis. Use the formatter as the authority instead of guessing another layout: from services/analysis-engine, run the repository-pinned uv run ruff format tests/test_codeql_action_revision_contract.py, inspect its exact diff, and commit only that formatter-produced change to the existing canonical branch. Do not change test semantics, expected CodeQL v4.37.8 SHA/version, workflows, dependencies, lockfiles, doctoring, release metadata, or any unrelated path.

Verification acceptance on the successor exact head: focused uv run ruff format --check tests/test_codeql_action_revision_contract.py, focused CodeQL revision-contract tests, then canonical ./scripts/harness/quickcheck.sh; refetch the new head/base and exact workflow checkout before claiming GREEN. Do not weaken a gate or paper over inherited dependency findings; #783 remains the dependency-security owner. Keep Draft/unmerged and do not self-approve.

[seonghobae]

@opencode-agent Repair only the current exact-head formatter blocker on the existing fix/codeql-action-consistency-v4-37-6 branch. Writer lease refetch immediately before any write: PR #780 must still be open Draft/unmerged at head d9b8e97fa00f2e0e34e15654a3d5ffa6e34ab75b against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9, and services/analysis-engine/tests/test_codeql_action_revision_contract.py must still be blob 03d26b3696dfdb09ed85313d61159eadc2d1ae0c; otherwise inspect movement and adapt instead of overwriting it.

Authoritative current-head RED evidence is CI run 32890724662, job 97941779134, actual checkout 78713d869dcc61c332b7defedb55aa8887ad8f39. Setup, npm/uv sync, Rust extension build, docs, security notes/patterns, supply-chain, GitHub bootstrap, workspace ESLint, Python docstrings, and Ruff lint all pass. The first and only quickcheck failure is repository-pinned Ruff 0.15.5 format --check, which reports exactly tests/test_codeql_action_revision_contract.py would be reformatted. gate / ci / rust-check job 97941779484 is independently successful.

Run the repository-pinned formatter (uv run --directory services/analysis-engine ruff format tests/test_codeql_action_revision_contract.py or the repository-equivalent pinned command), inspect its generated diff, and commit only that formatter-derived change. Do not hand-style, alter the CodeQL v4.37.8 SHA/version contract, workflows, CHANGELOG/doctoring, dependencies/lockfiles, security baseline, or unrelated files. Then run focused Ruff check/format plus the CodeQL revision contract tests and canonical ./scripts/harness/quickcheck.sh. Report the successor exact head and terminal evidence. Keep the PR Draft; do not merge, self-approve, or close the split Dependabot PRs yet. #783 owns inherited npm dependency security.

[seonghobae]

Succession update for #1144: fresh organization ruleset 18156473 (updated 2026-09-02T19:15:06.540+09:00) now explicitly requires central .github/workflows/codeql-pr.yml, so #1144's temporary repository-local PR trigger reached its removal condition and was closed after its Devin push-only-policy thread was addressed. Its narrower v4.37.8 init/autobuild/analyze bump is fully superseded here by the atomic v4.37.9 lifecycle at cdf488f595d80d6e07e03d4674febd5ab45fa938. No #1144 check/review evidence transfers to this head.