fix(security): keep every CodeQL Action phase on one revision

[seonghobae]

Problem

Dependabot opened separate updates for CodeQL init, autobuild, analyze, and upload-sarif. Merging them independently would create an unreviewed mixed CodeQL lifecycle. Exact-current-code review also found that the permanent repository guard had a fail-open shape: its scanner matched only references that already looked like 40-character hexadecimal SHAs. A future mutable github/codeql-action/init@v4 reference could therefore disappear from the evidence set instead of failing the exact-SHA invariant.

Exact current scope

Current exact head: 738495ca9d425fb34a12e76c0614eda356e68f3a.
Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.

Exactly six files differ from protected develop: the three CodeQL/SARIF workflow files, CHANGELOG.md, the CodeQL doctoring note, and the permanent Python contract test. There is no application dependency or root lockfile diff.

The branch pins every checked-in init, autobuild, analyze, and upload-sarif reference to CodeQL Action v4.37.7 target commit ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd, keeps the lifecycle atomic, corrects version annotations, adds a repository-wide revision contract, records the threat/update/rollback boundary in doctoring, and updates CHANGELOG under Unreleased. Workflow triggers, permissions, language selection, build behavior, SARIF paths, application dependencies, database, network authority, filesystem authority, model, and IPC surfaces are unchanged.

Upstream authority verification

The GitHub upstream state was revalidated directly against github/codeql-action on August 16, 2026. Matching v4.37.* refs end at v4.37.7; no v4.37.8 ref existed at this inspection point. v4.37.7 resolves through annotated tag object faaa5d804fc648d0fdb28822a8e36cf7d0a6132c to target commit ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd. The security claim is intentionally narrow: workflows execute the immutable target commit; no claim is made that the annotated tag object itself is signed.

Test-first guard hardening

The original contract established that the currently matched CodeQL phases use one exact reviewed SHA, but the strict matcher itself could ignore a mutable/non-SHA reference.

• RED-order commit 0e57921de5e8f0ef8b66a739c3d4110709753a60 adds test_reference_scanner_detects_non_sha_codeql_references, requiring a hypothetical @v4 reference to be visible to the scanner. The predecessor matcher deterministically returns no match for that fixture. Its repository workflow was superseded, so it is not represented as executed RED gate evidence without a qualifying terminal result.
• GREEN 30d92d54648976f3047b47ed86d8d43ee3407bcd broadens only the scanner token grammar. The existing invariant still requires the resulting revision set to equal the exact reviewed 40-character SHA, so mutable tags/branches are captured and rejected rather than skipped.
• Current head 738495ca9d425fb34a12e76c0614eda356e68f3a documents the fail-closed scanner behavior while retaining the existing APA 7 primary GitHub references.

The production workflow references themselves remain byte-identical to the previously reviewed v4.37.7 pinned state in this follow-up; only the guard/test documentation changed after that state.

Exact-head verification state

On exact head 738495ca9d425fb34a12e76c0614eda356e68f3a, repository ci, build-baseline, release, sbom, SAST Semgrep, bandit, and secret-scan-gate are terminal-success.

security-audit is terminal-failure. Exact job 95076635068 was inspected before classification: checkout/setup/install succeeded, Audit npm dependencies failed, and the subsequent Python/Rust audit steps were skipped. The annotation is only the generic exit-code-1 marker and the exact GitHub job-log endpoint returned an empty payload through the connector. This branch has no package/lockfile diff.

Aggregate Security Scan is terminal-failure. Exact run 31911292551 was inspected job-by-job: OSV base-vs-head comparison, Scorecard, and dependency-review are terminal-success; trivy-fs job 95076636392 fails at Print Trivy findings that failed the gate after the filesystem scan and SARIF-output requirement pass. Its annotation is a generic exit-code-1 marker and its log endpoint likewise returned an empty payload through the connector. The changed upload-sarif step runs after that finding gate and itself succeeds, so the failure is not introduced by this PR's CodeQL Action revision. Combined with the absence of dependency/lockfile changes and the successful PR-introduced OSV comparison, the whole-tree dependency failures are classified as inherited protected-base blockers owned by canonical #783, not suppressed or duplicated here.

The repository quickcheck's Python command is statement-coverage-only under the current BandScope coverage.py configuration; branch = true is not configured. Therefore a successful ci result must not be represented as proof of the user-required 100% Python branch coverage. That remains an explicit merge blocker until exact-head branch measurement exists.

No skipped audit stage, predecessor-head result, or inherited whole-tree failure is counted as success.

Review and dependency gates

There are currently no inline review threads and no qualifying independent non-author exact-current-head approval. Canonical #783 is repository-green on its exact head but has not reached protected develop; it remains dependent on central ContextualWisdomLab/.github#1008 plus qualifying independent approval. Central coverage/review therefore remains prerequisite-gated. Unchanged reviewer-agent work is not redispatched merely to reproduce that prerequisite failure.

Supersession

After this coordinated PR is exact-head green against the then-current protected base and review-complete, it supersedes split Dependabot PRs #764, #766, #767, and #768. Their predecessor checks/reviews are not transferable, and they are not closed before supersession is proven by protected integration.

Merge gate

Keep Draft until #783 establishes the canonical protected dependency baseline, this branch is refreshed/revalidated against the then-current develop, owned production statement and branch coverage is explicitly proven at 100%, every required repository and central check is terminal-success on the unchanged exact head, all actionable threads are resolved, a qualifying independent non-author last-push approval exists, and branch protection permits merge without bypass.

Queued, in-progress, skipped-required, failed inherited-base, predecessor-head, protected-base, self/author, or administrative-bypass evidence is not success.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 99ec039d-79c4-4a6b-9d31-a7f387975515

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

/oc Refetch the live pull request and abort without writing unless its exact head is 7c9343aede26a44239b12c805fdd0ab0b1398dba on branch fix/codeql-action-consistency-v4-37-6. Exact-head CI run 31170110007, job 92839810936, is the authoritative RED evidence: the Rust/Tauri gate passed; quickcheck reached Ruff after all documentation, security-pattern, supply-chain, bootstrap, frontend workspace lint, and docstring gates passed; the only quality failure is I001 for the import block in services/analysis-engine/tests/test_codeql_action_revision_contract.py. Apply the formatter-derived minimum repair only: from services/analysis-engine, run the repository-pinned uv run ruff check tests/test_codeql_action_revision_contract.py --select I --fix, inspect the diff, and commit only Ruff's canonical import-block ordering. Do not hand-guess another style, change the test behavior, CodeQL SHA/version contract, workflows, dependencies, lockfiles, doctoring, release metadata, or unrelated files. Run the focused Ruff check and the two CodeQL contract tests first, then the complete exact-head quickcheck, CI, Rust/Tauri, package/release, SBOM, Security Scan, SAST, and git diff --check. The known two high-severity JavaScript findings belong to atomic baseline PR #783 and must not be papered over here. Do not create another branch, PR, one-shot/self-modifying workflow, patch artifact, or encoded patch. Keep Draft until the new exact head is fully green, current-head actionable threads are zero, #783 has established the protected dependency baseline or this branch is rebased onto it, and a qualifying independent non-author approval exists.

[seonghobae]

Exact-head triage at 0a6ae2b4d749d473f3b0a451bed1a6a58c876080: CI/build/release/SBOM/Bandit/secret/Semgrep are green, but security-audit and Security Scan fail because this branch still inherits the protected-base npm findings for nanoid <3.3.18, pdfjs-dist <6.2.108, and undici <=7.28.0. Those are being remediated atomically by #783; duplicating that package/lockfile work here would create conflicting supply-chain ownership. Keep #780 blocked on #783 rather than copying its fix. After #783 lands, rebase/refresh #780 on the new develop, then require exact-new-head security and review evidence before Ready/merge.

[seonghobae]

@opencode-agent Review the exact current head 0a6ae2b4d749d473f3b0a451bed1a6a58c876080 against protected develop and submit a formal current-head decision. I re-verified upstream github/codeql-action annotated tag v4.37.6: it dereferences to commit 5595ccaf912efad79be6eef63a5619ff05969be3, matching every CodeQL phase and SARIF uploader in this PR. Do not reuse predecessor-head review evidence.