test(codeql): keep current-time fixtures fresh

[seonghobae]

Root cause

covered_by_recent_analysis() always generated timestamps relative to 2026-09-03T12:00:00Z. Two tests intentionally exercised production's default current-time path, so they became stale after the 35-day CodeQL freshness window and failed every unrelated PR full suite.

RED → GREEN

• RED on protected main@7554587c2e3106a388998bcad048a3d7121de25e: the two current-time/default-main cases failed 2/2.
• GREEN at exact head 8ba032a3df47c8f401a7017ae84302c725c2f9c8: keep the fixed clock for deterministic threshold tests, but inject the real UTC current time only into the two tests that exercise production's default clock.
• Focused: 30 passed normally and 30 passed with GITHUB_ACTIONS=true.
• Full repository suite: 5,158 passed, 11 skipped, 40 subtests.
• git diff --check: clean.

Boundary

Test fixture only. No production source, workflow, runner policy, dependency, security verdict, release, or protected-main state changes. This is the causal owner prerequisite for #2597's exact-tree verification.

Summary by CodeRabbit

• 테스트
  • 분석 시각을 기준 시각에 따라 설정하도록 테스트를 조정했습니다.
  • 현재 시각을 명시하는 테스트 사례를 추가하고 성공 경로를 업데이트했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 34cb1401-704a-47e9-9d11-c83c39f7c700

📥 Commits

Reviewing files that changed from the base of the PR and between 7554587 and 8ba032a.

📒 Files selected for processing (1)

• tests/test_audit_org_codeql_coverage.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

테스트용 분석 페이로드 생성 함수가 전달된 기준 시각을 사용하도록 변경되었습니다. 기본 동작 확인 테스트와 파일 입력 성공 경로 테스트는 현재 UTC 시각을 기준으로 분석 시각을 생성합니다.

Changes

분석 시각 기준 테스트

Layer / File(s)	Summary
기준 시각 매개변수와 테스트 갱신 tests/test_audit_org_codeql_coverage.py	covered_by_recent_analysis에 키워드 전용 now 매개변수를 추가했습니다. 관련 테스트는 현재 UTC 시각을 전달합니다.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 8ba03

This change updates test fixtures to use the current UTC time where appropriate. No merge-blocking risk is identified; proceed with normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		제목은 오래된 CodeQL 테스트 픽스처를 현재 시각 기준으로 갱신하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current authority — exact prerequisite head

• Lifecycle: Ready / Proposed / merge HOLD. Ready is review admission, not merge authorization.
• Exact head: 8ba032a3df47c8f401a7017ae84302c725c2f9c8; tree 8de1d8a7a7474b8d08f89419d9acd9e389668841; parent protected main@7554587c2e3106a388998bcad048a3d7121de25e.
• Scope remains one test fixture file. RED reproduced the two stale current-time failures on protected main. GREEN is 30/30 normally, 30/30 with GITHUB_ACTIONS=true, and the full repository suite is 5,158 passed, 11 skipped, 40 subtests.
• Exact-head CodeQL PR run 37893551706, job 113699648318, failed before any executable step: steps=null and no job log. This is runner/admission evidence, not a source failure log; an unchanged-source rerun is not justified.
• Dependent fix(security): make GitHub redirect rejection explicit #2597 now targets this branch and includes this exact commit as ordinary merge parent 2. Its protected-base-relative prerequisite file is absent from the child diff.

Approval remains 0 and the hosted failure is terminal, so no merge/auto-merge/bypass is authorized.

[seonghobae]

Downstream carryover receipt for exact #2609 head 8ba032a3df47c8f401a7017ae84302c725c2f9c8 (COMMENT, not approval): #2606's first merged tree reproduced this owner's exact two stale current-time failures (5,512 passed, 2 failed). #2606 then integrated this exact head as parent 2 of ordinary merge 9c209b3bed74c5af91d00905777400134be34e9c instead of copying the fix. Its combined-tree suite is 5,514 passed, 10 skipped, 40 subtests, and its child comparison exposes the fixture as a prerequisite-owned file. #2609 remains Ready / Proposed / merge HOLD pending its own terminal exact-head Checks and qualifying approval; this downstream receipt does not alter its lifecycle or authorize bypass/merge.

[seonghobae]

Downstream carryover receipt for exact #2609 head 8ba032a3df47c8f401a7017ae84302c725c2f9c8 (COMMENT, not approval): refreshed GRC stack #2602 integrates this exact head as parent 2 of ordinary merge ab4a39d818a1d865852e25a97b4200e08ece0bbb instead of duplicating its clock-fixture repair. Runner-routing conflicts from #2609's main ancestry were resolved to canonical owner #2565; this PR's fixture blob remains exact. The #2602 combined suite is 5,498 passed, 10 skipped, 40 subtests. #2609 remains Ready / Proposed / merge HOLD pending its own exact-head Checks and qualifying approval.

[seonghobae]

Downstream stack receipt — #2603

PR #2603 includes this fixture prerequisite as an ordinary second parent at exact SHA 8ba032a3df47c8f401a7017ae84302c725c2f9c8.

Downstream exact head is 5d7fefa7e56300dfc8732929664ec199aa7fafa9; tree 1514f59370af630952cad2086b09ad60b973c2b4. The #2609 delta remains the single current-time CodeQL fixture file and passed within the downstream full suite (5,535 passed, 10 skipped, 40 subtests).

[seonghobae]

Downstream stack receipt — #2581

PR #2581 now consumes this exact fixture head 8ba032a3df47c8f401a7017ae84302c725c2f9c8 together with #2565 owner head 8d4a2eb1061c060360741d4015e4350ffde6a3eb.

Downstream exact head: 431c575f9778e727ef2ec071e57eb334564bd737; tree: 8d4fd8b7ee22e2eef92e14ed294071e10497fbc3. The combined full warning-fatal suite passed 5,536 tests with 10 skips and 40 subtests.

[seonghobae]

Prerequisite carryover evidence: this PR’s current-time CodeQL fixture delta at exact head 8ba032a3df47c8f401a7017ae84302c725c2f9c8 is now an explicit merge parent of canonical owner #2283 exact head e7eacd952847fc149851a40ef50f61d90cb4e12c. It resolved the two time-dependent full-suite failures; the integrated tree passed 204 focused contracts in both environments and the full warnings-as-errors suite (5186 passed, 11 skipped, 40 subtests passed). #2609 remains open; this is preservation evidence, not closure or merge authorization.

[seonghobae]

Gyeot clock-test coordination — #2611 exact87a371a7783fa16f6988c9c98da8e5eb5820eae7

Your current-time fixture repair at8ba032a3df47c8f401a7017ae84302c725c2f9c8 remains open and is not superseded/closed by this consumer. Full central acceptance on Gyeot base7554587 independently reproduced the two stale Sept3fixtures on October9. The local consumer adds a deterministic module-local FrozenDateTime seam, asserts default now requests timezone.utc, and exercises CLI exactly35days ->PASS and35days+1microsecond ->FAIL, with production clock/freshness unchanged. The repaired audit suite passes31tests; independent source review accepted this scope. The delta is now in #2611 (alongside separate sandbox fixes), so eventual integration must reconcile the overlap rather than reapply old text or treat either PR as automatically superseded. No source changes were made to your branch.