CodeQL scan-dispatch repository gate accepts non-canonical trailing-dot and embedded-dotdot targets #2264

Problem

Protected main@64aa08d7fa487deacd41c761c36277ca68cab6c9 still validates TARGET_REPOSITORY in .github/workflows/codeql-scan-dispatch.yml with:

[[ "$TARGET_REPOSITORY" =~ ^ContextualWisdomLab/[A-Za-z0-9_.-]+$ ]]

That organization-membership check accepts non-canonical repository slugs such as ContextualWisdomLab/repository. and ContextualWisdomLab/repo..name.

The same protected owner now rejects embedded .. and trailing . components in the scheduler/source-fix repository-identity contract. The CodeQL dispatch trust boundary is therefore looser than the canonical repository identity used by its producer/coordination plane.

This is independent of the queue-health parser drift tracked separately in #2263: both are consumers of repository identity, but CodeQL scan dispatch is a security-sensitive repository_dispatch admission path.

RED

Add contract coverage that exercises the actual workflow admission expression for at least:

• ContextualWisdomLab/repository. → reject
• ContextualWisdomLab/repo..name → reject
• ContextualWisdomLab/.. → reject
• ContextualWisdomLab/. → reject
• a valid dotted/hyphenated repository name → accept

Do not test only a replacement regex detached from the workflow text.

Minimum causal fix

Align the workflow target-repository gate with the current canonical invariant: retain the ContextualWisdomLab/ owner restriction and allowed slug characters, but reject any repository component containing .. or ending in ..

Preserve the existing actor+sender authorization, v1/v2 protocol binding, exact PR head/base validation, producer-source binding, matrix/rerun validation, credential boundary, and fail-closed semantics.

If a reusable/versioned repository-identity helper can be consumed by workflow admission without introducing a mutable runtime dependency, prefer that; otherwise pin the invariant with workflow contract tests to prevent another drift.

Acceptance

• hostile target repository cases are RED against current protected production workflow;
• minimum admission fix makes them GREEN without changing valid dispatch behavior;
• existing CodeQL dispatch protocol/security contracts remain GREEN on the exact head;
• no manual dispatch, synthetic status, gate weakening, or leaf-workflow copy is introduced;
• downstream/stale branches adopt the repaired protected slice path-wise rather than copying this pre-fix workflow wholesale.