fix(OMN-12432): authenticate uv git+https fetches in CI (Empty reply from server)

.github/actions/setup-python-uv/action.yml

@@ -41,16 +41,21 @@ inputs:
   sync-attempts:
     description: 'Maximum uv sync attempts before failing'
     required: false
-    default: '3'
+    default: '5'
   sync-retry-delay-seconds:
     description: 'Base delay in seconds between uv sync retries'
     required: false
     default: '10'
+  github-token:
+    description: >-
+      Token used to authenticate uv git+https dependency fetches against github.com. Defaults to the workflow GITHUB_TOKEN, which authenticates same-org public-repo fetches and lifts them above the anonymous rate limit. Override with `secrets.CROSS_REPO_PAT` for private cross-repo deps.
+    required: false
+    default: ${{ github.token }}
 runs:
   using: 'composite'
   steps:
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ inputs.python-version }}
     - name: Install uv
@@ -75,9 +80,27 @@ runs:
         INSTALL_ARGS: ${{ inputs.install-args }}
         UV_SYNC_ATTEMPTS: ${{ inputs.sync-attempts }}
         UV_SYNC_RETRY_DELAY_SECONDS: ${{ inputs.sync-retry-delay-seconds }}
+        GIT_FETCH_TOKEN: ${{ inputs.github-token }}
       run: |
         export UV_HTTP_TIMEOUT="${UV_HTTP_TIMEOUT:-600}"
+        export UV_CONCURRENT_DOWNLOADS="${UV_CONCURRENT_DOWNLOADS:-1}"
+        export UV_CONCURRENT_BUILDS="${UV_CONCURRENT_BUILDS:-1}"
         git config --global http.version HTTP/1.1
+        # Authenticate uv's internal git+https fetches. Anonymous github.com
+        # requests are rate-limited (60/hr); many parallel --no-cache syncs from
+        # one runner egress IP trip "Empty reply from server". Authenticated
+        # requests get 5000/hr. uv shells out to `git fetch`, which inherits the
+        # GIT_CONFIG_* env vars below — a process-scoped insteadOf rewrite that
+        # never writes the token to a persistent gitconfig on the self-hosted
+        # runner. (OMN-12432)
+        if [ -n "${GIT_FETCH_TOKEN}" ]; then
+          export GIT_CONFIG_COUNT=1
+          export GIT_CONFIG_KEY_0="url.https://x-access-token:${GIT_FETCH_TOKEN}@github.com/.insteadOf"
+          export GIT_CONFIG_VALUE_0="https://github.com/"
+          echo "git github.com fetches: authenticated (x-access-token)"
+        else
+          echo "::warning::github-token not provided; uv git fetches stay anonymous and may be rate-limited"
+        fi
         read -r -a install_args <<< "$INSTALL_ARGS"
         sync_attempts="${UV_SYNC_ATTEMPTS}"
         retry_delay_seconds="${UV_SYNC_RETRY_DELAY_SECONDS}"

.github/codeql/codeql-config.yml

@@ -0,0 +1,9 @@
+# SPDX-FileCopyrightText: 2025 OmniNode.ai Inc.
+# SPDX-License-Identifier: MIT
+name: omnibase-infra-codeql
+paths:
+  - src
+  - scripts
+  - tests
+paths-ignore:
+  - .github/**

.github/workflows/check-handshake.yml

@@ -19,7 +19,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 5
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repo

.github/workflows/ci.yml

@@ -128,7 +128,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 10
+    timeout-minutes: 20
 
     steps:
       - name: Checkout code
@@ -314,7 +314,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 5
+    timeout-minutes: 15
 
     steps:
       - name: Checkout code
@@ -461,7 +461,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 25
+    timeout-minutes: 45
 
     steps:
       - name: Checkout omnibase_infra
@@ -502,6 +502,25 @@ jobs:
           lock-file-path: 'omnibase_infra/**/uv.lock'
           working-directory: omnibase_infra
 
+      - name: Preinstall CPU-only torch for sibling deps
+        working-directory: omnibase_infra
+        run: |
+          set -eu
+          export UV_HTTP_TIMEOUT="${UV_HTTP_TIMEOUT:-600}"
+          attempt=1
+          max_attempts=5
+          until uv pip install "torch>=2.6.0,<3.0.0" --index-url https://download.pytorch.org/whl/cpu; do
+            status=$?
+            if [ "${attempt}" -ge "${max_attempts}" ]; then
+              echo "::error::uv pip install schema-handshake torch CPU wheel failed after ${attempt} attempt(s)"
+              exit "${status}"
+            fi
+            delay=$((attempt * 10))
+            echo "::warning::uv pip install schema-handshake torch CPU wheel attempt ${attempt}/${max_attempts} failed with exit ${status}; retrying in ${delay}s"
+            attempt=$((attempt + 1))
+            sleep "${delay}"
+          done
+
       - name: Install sibling repos as editable (boundary pair deps)
         working-directory: omnibase_infra
         # Use --overrides to install siblings with their full transitive deps while
@@ -512,10 +531,24 @@ jobs:
         # Prior approach (--no-deps) skipped transitive deps entirely, causing
         # ModuleNotFoundError for packages like adaptive_classifier at collection time.
         run: |
+          set -eu
           INFRA_VERSION=$(python -c "import tomllib; d=tomllib.load(open('pyproject.toml','rb')); print(d['project']['version'])")
           echo "omnibase-infra==${INFRA_VERSION}" > /tmp/sibling-overrides.txt
           echo "omnibase-compat @ file://$(pwd)/../omnibase_compat" >> /tmp/sibling-overrides.txt
-          uv pip install --overrides /tmp/sibling-overrides.txt -e ../omniintelligence
+          export UV_HTTP_TIMEOUT="${UV_HTTP_TIMEOUT:-600}"
+          attempt=1
+          max_attempts=5
+          until uv pip install --overrides /tmp/sibling-overrides.txt -e ../omniintelligence; do
+            status=$?
+            if [ "${attempt}" -ge "${max_attempts}" ]; then
+              echo "::error::uv pip install schema-handshake sibling deps failed after ${attempt} attempt(s)"
+              exit "${status}"
+            fi
+            delay=$((attempt * 10))
+            echo "::warning::uv pip install schema-handshake sibling deps attempt ${attempt}/${max_attempts} failed with exit ${status}; retrying in ${delay}s"
+            attempt=$((attempt + 1))
+            sleep "${delay}"
+          done
 
       - name: Run schema handshake validation (changed-only)
         working-directory: omnibase_infra
@@ -1216,7 +1249,7 @@ jobs:
         && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
         || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
       }}
-    timeout-minutes: 25
+    timeout-minutes: 45
 
     steps:
       - name: Checkout omnibase_infra
@@ -1265,7 +1298,18 @@ jobs:
           INFRA_VERSION=$(python -c "import tomllib; d=tomllib.load(open('pyproject.toml','rb')); print(d['project']['version'])")
           echo "omnibase-infra==${INFRA_VERSION}" > /tmp/sibling-overrides.txt
           echo "omnibase-compat @ file://$(pwd)/../omnibase_compat" >> /tmp/sibling-overrides.txt
-          uv pip install --overrides /tmp/sibling-overrides.txt -e ../omniintelligence
+          attempt=1
+          max_attempts=5
+          until uv pip install --overrides /tmp/sibling-overrides.txt -e ../omniintelligence; do
+            status=$?
+            if [ "${attempt}" -ge "${max_attempts}" ]; then
+              echo "::error::uv pip install sibling deps failed after ${attempt} attempt(s)"
+              exit "${status}"
+            fi
+            echo "::warning::uv pip install sibling deps attempt ${attempt}/${max_attempts} failed with exit ${status}; retrying in 10s"
+            attempt=$((attempt + 1))
+            sleep 10
+          done
 
       - name: Run Kafka boundary compatibility tests
         working-directory: omnibase_infra

.github/workflows/omni-standards-compliance.yml

@@ -31,19 +31,15 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Setup Python and uv
+        uses: ./.github/actions/setup-python-uv
         with:
           python-version: ${{ env.PYTHON_VERSION }}
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
-          enable-cache: false
-
-      - name: Install dependencies
-        run: uv sync --no-cache --all-extras
+          uv-version: ${{ env.UV_VERSION }}
+          cache-enabled: "false"
+          cache-key-prefix: uv-type-safety
+          install-args: --all-extras
+          github-token: ${{ secrets.CROSS_REPO_PAT || github.token }}
 
       - name: Run MyPy type checking
         run: |
@@ -67,19 +63,15 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Setup Python and uv
+        uses: ./.github/actions/setup-python-uv
         with:
           python-version: ${{ env.PYTHON_VERSION }}
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ env.UV_VERSION }}
-          enable-cache: false
-
-      - name: Install dependencies
-        run: uv sync --no-cache --all-extras
+          uv-version: ${{ env.UV_VERSION }}
+          cache-enabled: "false"
+          cache-key-prefix: uv-type-union
+          install-args: --all-extras
+          github-token: ${{ secrets.CROSS_REPO_PAT || github.token }}
 
       - name: Check for Optional/Union usage (PEP 604)
         run: uv run ruff check src/ --select UP007,UP006
@@ -108,7 +100,17 @@ jobs:
           version: ${{ env.UV_VERSION }}
 
       - name: Install onex_change_control (pinned)
+        env:
+          GIT_FETCH_TOKEN: ${{ secrets.CROSS_REPO_PAT || github.token }}
         run: |
+          # Authenticate the git+https fetch so it isn't anonymous-rate-limited
+          # on the self-hosted runner ("Empty reply from server"). Process-scoped
+          # insteadOf rewrite; never writes the token to disk. (OMN-12432)
+          if [ -n "${GIT_FETCH_TOKEN}" ]; then
+            export GIT_CONFIG_COUNT=1
+            export GIT_CONFIG_KEY_0="url.https://x-access-token:${GIT_FETCH_TOKEN}@github.com/.insteadOf"
+            export GIT_CONFIG_VALUE_0="https://github.com/"
+          fi
           uv venv .venv --python "${pythonLocation}/bin/python"
           . .venv/bin/activate
           uv pip install "onex_change_control @ git+https://github.com/OmniNode-ai/onex_change_control.git@08a5194c6e587e8b2256c1f1edde236ad34cd397"

.github/workflows/security-scan.yml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 #
 # CodeQL security and quality analysis for omnibase_infra.
-# Calls the reusable workflow in onex_change_control.
+# Kept repo-local so CodeQL can use the repo config that excludes CI metadata.
 # OMN-5425
 
 name: Security Scan
@@ -19,11 +19,34 @@ on:
 jobs:
   codeql:
     name: CodeQL
-    uses: OmniNode-ai/onex_change_control/.github/workflows/codeql-reusable.yml@main
-    with:
-      language: python
-      query_suite: security-and-quality
+    runs-on: >-
+      ${{
+        (github.event_name == 'pull_request' &&
+         github.event.pull_request.head.repo.full_name != github.repository)
+        && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON || '["ubuntu-latest"]')
+        || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON || '["self-hosted","omnibase-ci"]')
+      }}
     permissions:
       actions: read
       contents: read
       security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          queries: security-and-quality
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:python
+          upload: never
+          wait-for-processing: false