chore(deps): bump github/codeql-action from 4.35.1 to 4.35.4

.github/workflows/codeql.yml

@@ -29,12 +29,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4

.github/workflows/opencode-review.yml

@@ -1383,7 +1383,7 @@ jobs:
             local runs_json
 
             runs_json="$(mktemp)"
-            if ! gh api -X GET "repos/${GH_REPOSITORY}/actions/workflows/strix.yml/runs?event=pull_request_target&per_page=30" >"$runs_json"; then
+            if ! gh api -X GET "repos/${GH_REPOSITORY}/actions/workflows/strix.yml/runs?per_page=100" >"$runs_json"; then
               rm -f "$runs_json"
               return 1
             fi
@@ -1394,7 +1394,7 @@ jobs:
                   (.workflow_runs // [])
                   | map(
                       select((.head_sha // "") == $head_sha)
-                      | select((.event // "") == "pull_request_target")
+                      | select((.event // "") == "pull_request_target" or (.event // "") == "workflow_dispatch")
                       | select((.status // "") == "completed")
                       | select((.conclusion // "" | ascii_upcase) as $c | ["FAILURE","TIMED_OUT","ACTION_REQUIRED","CANCELLED","STARTUP_FAILURE"] | index($c))
                       | "- Strix Security Scan/strix workflow run: " + (.conclusion // "unknown") + (if (.html_url // "") != "" then " (" + .html_url + ")" else "" end)
@@ -1407,7 +1407,7 @@ jobs:
                   (.workflow_runs // [])
                   | map(
                       select((.head_sha // "") == $head_sha)
-                      | select((.event // "") == "pull_request_target")
+                      | select((.event // "") == "pull_request_target" or (.event // "") == "workflow_dispatch")
                       | select((.status // "") != "completed")
                       | "- Strix Security Scan/strix workflow run: " + (.status // "unknown") + (if (.html_url // "") != "" then " (" + .html_url + ")" else "" end)
                     )
@@ -1423,14 +1423,67 @@ jobs:
             rm -f "$runs_json"
           }
 
+          collect_current_head_strix_success_run_ids() {
+            local output_file="$1"
+
+            HEAD_SHA="$HEAD_SHA" gh run list \
+              --repo "$GH_REPOSITORY" \
+              --commit "$HEAD_SHA" \
+              --limit 100 \
+              --json databaseId,workflowName,status,conclusion,event,headSha \
+              --jq '
+                .[]
+                | select((.event // "") == "pull_request_target" or (.event // "") == "workflow_dispatch")
+                | select((.headSha // "") == env.HEAD_SHA)
+                | select((.workflowName // "") == "Strix Security Scan" or (.workflowName // "") == "Strix")
+                | select((.status // "") == "completed")
+                | select((.conclusion // "" | ascii_downcase) == "success")
+                | ((.databaseId // "") | tostring)
+              ' >"$output_file"
+          }
+
+          filter_superseded_strix_failure_lines() {
+            local input_file="$1"
+            local output_file="$2"
+            local latest_success_run_id="$3"
+
+            if [ -z "$latest_success_run_id" ]; then
+              cat "$input_file" >"$output_file"
+              return 0
+            fi
+
+            awk -v latest_success_run_id="$latest_success_run_id" '
+              /Strix Security Scan/ {
+                line = $0
+                run_id = 0
+                if (line ~ /actions\/runs\/[0-9]+/) {
+                  sub(/^.*actions\/runs\//, "", line)
+                  sub(/[^0-9].*$/, "", line)
+                  run_id = line + 0
+                }
+                if (run_id > 0 && run_id < (latest_success_run_id + 0)) {
+                  next
+                }
+              }
+              { print }
+            ' "$input_file" >"$output_file"
+          }
+
           collect_failed_github_checks() {
             local output_file="$1"
             local owner="${GH_REPOSITORY%%/*}"
             local name="${GH_REPOSITORY#*/}"
             local rollup_file
             local strix_runs_file
+            local combined_file
+            local filtered_file
+            local strix_success_run_ids_file
+            local latest_strix_success_run_id
             rollup_file="$(mktemp)"
             strix_runs_file="$(mktemp)"
+            combined_file="$(mktemp)"
+            filtered_file="$(mktemp)"
+            strix_success_run_ids_file="$(mktemp)"
             # shellcheck disable=SC2016
             if ! gh api graphql \
               -f owner="$owner" \
@@ -1485,20 +1538,27 @@ jobs:
                   )
                 | .[]
               ' >"$rollup_file"; then
-              rm -f "$rollup_file" "$strix_runs_file"
+              rm -f "$rollup_file" "$strix_runs_file" "$combined_file" "$filtered_file" "$strix_success_run_ids_file"
               return 1
             fi
 
             if ! collect_current_head_strix_workflow_runs "$strix_runs_file" failed; then
-              rm -f "$rollup_file" "$strix_runs_file"
+              rm -f "$rollup_file" "$strix_runs_file" "$combined_file" "$filtered_file" "$strix_success_run_ids_file"
               return 1
             fi
             if grep -Fq -- "Strix Security Scan/strix:" "$rollup_file"; then
-              cat "$rollup_file" >"$output_file"
+              cat "$rollup_file" >"$combined_file"
             else
-              cat "$rollup_file" "$strix_runs_file" >"$output_file"
+              cat "$rollup_file" "$strix_runs_file" >"$combined_file"
             fi
-            rm -f "$rollup_file" "$strix_runs_file"
+            if collect_current_head_strix_success_run_ids "$strix_success_run_ids_file" && [ -s "$strix_success_run_ids_file" ]; then
+              latest_strix_success_run_id="$(sort -n "$strix_success_run_ids_file" | tail -n 1)"
+              filter_superseded_strix_failure_lines "$combined_file" "$filtered_file" "$latest_strix_success_run_id"
+              cat "$filtered_file" >"$output_file"
+            else
+              cat "$combined_file" >"$output_file"
+            fi
+            rm -f "$rollup_file" "$strix_runs_file" "$combined_file" "$filtered_file" "$strix_success_run_ids_file"
 
           }
 

.github/workflows/scorecard.yml

@@ -37,6 +37,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13  # v4.35.1
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e  # v4.35.4
         with:
           sarif_file: results.sarif

scripts/ci/collect_failed_check_evidence.sh

@@ -176,12 +176,53 @@ owner="${GH_REPOSITORY%%/*}"
 repo="${GH_REPOSITORY#*/}"
 failed_contexts="$(mktemp)"
 workflow_run_contexts="$(mktemp)"
-tmp_files=("$failed_contexts" "$workflow_run_contexts")
+strix_success_run_ids="$(mktemp)"
+tmp_files=("$failed_contexts" "$workflow_run_contexts" "$strix_success_run_ids")
 cleanup() {
 	rm -f "${tmp_files[@]}"
 }
 trap cleanup EXIT
 
+collect_current_head_strix_success_run_ids() {
+	local output_file="$1"
+
+	HEAD_SHA="$HEAD_SHA" gh run list \
+		--repo "$GH_REPOSITORY" \
+		--commit "$HEAD_SHA" \
+		--limit 100 \
+		--json databaseId,workflowName,status,conclusion,event,headSha \
+		--jq '
+			.[]
+			| select((.event // "") == "pull_request_target" or (.event // "") == "workflow_dispatch")
+			| select((.headSha // "") == env.HEAD_SHA)
+			| select((.workflowName // "") == "Strix Security Scan" or (.workflowName // "") == "Strix")
+			| select((.status // "") == "completed")
+			| select((.conclusion // "" | ascii_downcase) == "success")
+			| ((.databaseId // "") | tostring)
+		' >"$output_file"
+}
+
+filter_superseded_strix_failures() {
+	local contexts_file="$1"
+	local latest_success_run_id="$2"
+	local filtered_contexts
+
+	if [ -z "$latest_success_run_id" ]; then
+		return 0
+	fi
+
+	filtered_contexts="$(mktemp)"
+	tmp_files+=("$filtered_contexts")
+	awk -F '\t' -v latest_success_run_id="$latest_success_run_id" '
+		BEGIN { OFS = FS }
+		$2 ~ /Strix/ && $5 ~ /^[0-9]+$/ && ($5 + 0) < (latest_success_run_id + 0) {
+			next
+		}
+		{ print }
+	' "$contexts_file" >"$filtered_contexts"
+	cp "$filtered_contexts" "$contexts_file"
+}
+
 # shellcheck disable=SC2016
 gh api graphql \
 	-f owner="$owner" \
@@ -287,6 +328,11 @@ while IFS=$'\t' read -r kind label conclusion details_url run_id check_run_id; d
 	printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$kind" "$label" "$conclusion" "$details_url" "$run_id" "$check_run_id" >>"$failed_contexts"
 done <"$workflow_run_contexts"
 
+if collect_current_head_strix_success_run_ids "$strix_success_run_ids" && [ -s "$strix_success_run_ids" ]; then
+	latest_strix_success_run_id="$(sort -n "$strix_success_run_ids" | tail -n 1)"
+	filter_superseded_strix_failures "$failed_contexts" "$latest_strix_success_run_id"
+fi
+
 {
 	printf '# Failed GitHub Check Evidence\n\n'
 	printf -- '- PR: #%s\n' "$PR_NUMBER"

scripts/ci/strix_quick_gate.sh

@@ -1934,6 +1934,16 @@ evaluate_pull_request_findings() {
 	return 1
 }
 
+pull_request_findings_allow_current_change() {
+	case "$PR_FINDINGS_DECISION" in
+	allow_absent_placeholder_secret | allow_baseline | allow_manifest_only)
+		return 0
+		;;
+	esac
+
+	return 1
+}
+
 fallback_models_raw_for_model() {
 	local model="$1"
 
@@ -3074,7 +3084,7 @@ run_current_target_scan() {
 	fi
 
 	if evaluate_pull_request_findings; then
-		if [ "$PR_FINDINGS_DECISION" = "allow_absent_placeholder_secret" ]; then
+		if pull_request_findings_allow_current_change && [ "$strict_primary_provider_fallback" -eq 0 ]; then
 			return 0
 		fi
 		if [ "$strict_primary_provider_fallback" -eq 0 ]; then
@@ -3137,7 +3147,7 @@ run_current_target_scan() {
 		fi
 
 		if evaluate_pull_request_findings; then
-			if [ "$PR_FINDINGS_DECISION" = "allow_absent_placeholder_secret" ]; then
+			if pull_request_findings_allow_current_change && [ "$strict_fallback_provider_signal" -eq 0 ]; then
 				return 0
 			fi
 			if [ "$strict_fallback_provider_signal" -eq 0 ]; then
@@ -3165,6 +3175,10 @@ run_current_target_scan() {
 		fi
 		done
 
+	if pull_request_findings_allow_current_change; then
+		return 0
+	fi
+
 	if should_fail_pull_request_infra_zero_findings; then
 		return 1
 	fi