ci(codeql): centralize CodeQL as a reusable workflow + org rollout handoff by cryptoxdog · Pull Request #3 · Quantum-L9/Cursor-Governance

cryptoxdog · 2026-07-05T02:27:48Z

Summary

Makes CodeQL security + code-quality analysis org-wide from a single source of truth hosted here in Cursor-Governance. Every other Quantum-L9 repo enables it with one ~18-line thin caller and no local config — change the analysis once here and it propagates to all callers pinned at @main.

What's in this PR

File	Role
`.github/workflows/codeql-reusable.yml`	Reusable (`workflow_call`) analysis: language auto-detect + per-language build-mode (interpreted → `none`, compiled → `autobuild`) → no standalone autobuild step, portable to any L9 repo.
`.github/codeql/codeql-config.yml`	Shared policy: `security-and-quality` suite + `query-filters: exclude precision:low` + `paths-ignore` incl. `tests/`. Source-level noise suppression, not per-alert dismissal.
`.github/workflows/codeql.yml`	This repo's thin caller (self-scan) + `pull_request: paths-ignore` to skip docs-only PRs.
`docs/handoffs/codeql-caller-template.yml`	Verbatim caller to copy into every other repo.
`docs/handoffs/CODEQL_ROLLOUT_HANDOFF.md`	Exemplary GMP-format handoff to roll the caller to all repos under `github.com/Quantum-L9` — admin runbook, sequencing, verification ladder, DORA block.

Tuning folded in (reduce friction / increase autonomy)

build-mode: none for Python (autobuild step removed) — done portably so compiled-language repos still work.
Skip docs-only PRs via pull_request: paths-ignore + ignore tests/ in config.
query-filters: exclude precision:low — cut low-precision noise at source before it trains people to ignore the bot.

Guardrails (non-negotiable)

No auto-commit, ever — Copilot Autofix / reviewer suggestions stay suggestion-only; a human reviews every diff.
Explicit, versioned suppression only (query-filters/paths-ignore), never silent mass-dismissal.
Org invariant — all repo routes stay under https://github.com/Quantum-L9/.

Validation

Static (passes): YAML + structure for all four workflow/config files; detect build-mode logic simulated on real language data (python/none), plus compiled/mixed/docs-only/API-failure edge cases degrade correctly.
Runtime (pending, honest): CodeQL can't run without a GitHub-hosted runner. First real proof is the initial Actions run after this merges to main (callers pin @main). CI is not claimed green until that run passes — see the handoff's Level-5 steps.

Rollout (after merge)

Merge this → add the caller template to each non-archived Quantum-L9 repo (delete any local .github/codeql/) → switch each repo's CodeQL default setup → advanced → verify. Full step-by-step in docs/handoffs/CODEQL_ROLLOUT_HANDOFF.md. This session's write scope is limited to L9-Ops-MCP and Cursor-Governance, so the org-wide caller rollout is handed off there for an authorized session/engineer.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rr6wpk9eehnJdRmh5BwWGG

Generated by Claude Code

Same config-as-code CodeQL workflow used org-wide across Quantum-L9 repos: a detect job builds the analysis matrix from the repo's actual languages, and the shared .github/codeql/codeql-config.yml supplies the security-and-quality suite (security + maintainability/code-quality queries). Byte-identical to the L9-Ops-MCP copy so it stays in sync across all L9 repositories. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rr6wpk9eehnJdRmh5BwWGG

…ndoff Convert the standalone CodeQL setup into a single org-wide source of truth hosted here in Cursor-Governance: - .github/workflows/codeql-reusable.yml: reusable (workflow_call) analysis with language auto-detection and per-language build-mode (interpreted -> none, compiled -> autobuild), so the standalone autobuild step is gone and the same workflow stays portable to any L9 repo. - .github/codeql/codeql-config.yml: add query-filters (exclude precision:low) and ignore tests/ — source-level noise suppression, not per-alert dismissal. - .github/workflows/codeql.yml: converted to a thin caller (self-scan) plus a pull_request paths-ignore filter to skip docs-only PRs. - docs/handoffs/codeql-caller-template.yml: verbatim ~18-line caller for every other Quantum-L9 repo. - docs/handoffs/CODEQL_ROLLOUT_HANDOFF.md: exemplary GMP-format handoff to roll the caller to all repos under github.com/Quantum-L9, with admin runbook, sequencing, verification ladder, and no-auto-commit guardrails. Static validation (YAML, structure, detection logic) passes; runtime CodeQL verification is pending the first Actions run after merge to main. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rr6wpk9eehnJdRmh5BwWGG

Copilot

Pull request overview

Centralizes CodeQL security + code-quality scanning for the Quantum-L9 org by introducing a reusable workflow (single “source of truth”) plus a standardized thin caller workflow and rollout handoff documentation.

Changes:

Adds a reusable CodeQL workflow that detects repo languages and sets per-language build-mode, then runs init + analyze.
Adds a shared CodeQL configuration (query suite + query-filters + paths-ignore) intended to be used org-wide.
Adds a thin caller workflow + a copy/paste caller template and an org rollout handoff/runbook.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`.github/workflows/codeql-reusable.yml`	Introduces org-wide reusable CodeQL workflow with language detection and per-language build mode.
`.github/codeql/codeql-config.yml`	Defines shared CodeQL query policy and ignore rules.
`.github/workflows/codeql.yml`	Adds this repo’s thin caller that invokes the reusable workflow (self-scan).
`docs/handoffs/codeql-caller-template.yml`	Provides a verbatim thin-caller template for other Quantum-L9 repos.
`docs/handoffs/CODEQL_ROLLOUT_HANDOFF.md`	Documents the rollout plan/runbook and verification ladder for org-wide adoption.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Move `permissions: contents: read` from workflow-level to the `detect` job in codeql-reusable.yml (least privilege; SonarCloud githubactions:S8264). - CODEQL_ROLLOUT_HANDOFF.md: drop hardcoded feature-branch reference in the Status line and the AI-session-specific write-scope parenthetical, per Copilot review comments. Note: codeql.yml's `@main` pin (SonarCloud githubactions:S7637) is left as-is intentionally — pinning to a full commit SHA is circular for a workflow that self-references its own repo pre-merge. Plan: tag v1/v1.0.0 after merge (matching the l9-ci-core kernel convention) and bump the pin in a follow-up PR.

cursor · 2026-07-20T01:54:48Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

cryptoxdog · 2026-07-20T01:57:50Z

Remediation pass:

Fixed SonarCloud githubactions:S8264 — moved permissions: contents: read from workflow-level to the detect job in codeql-reusable.yml (400691f).
Fixed the 2 legitimate Copilot doc nits (stale branch ref, stale AI-session parenthetical) in CODEQL_ROLLOUT_HANDOFF.md (400691f).
Rejected the other 2 Copilot comments as false positives — config-file: owner/repo/path@ref is a documented, supported CodeQL Action feature for cross-repo config sharing (cited GitHub docs + config-utils.ts source in the thread replies).
Left as-is (by design): codeql.yml's uses: ...codeql-reusable.yml@main (SonarCloud githubactions:S7637, wants a full-SHA pin). This is circular pre-merge — the workflow can't reference a commit SHA that doesn't exist until after it merges. Plan: merge, then tag v1/v1.0.0 (matching the l9-ci-core kernel convention already documented in Quantum-L9/.github/workflow-interface-registry.yml), then bump the pin in a follow-up PR. This SonarCloud finding will likely still show until that follow-up lands.

SonarCloud S7637 (MAJOR, failing the Quality Gate's Security Rating on New Code): codeql.yml referenced codeql-reusable.yml@main -- a mutable ref is a supply-chain risk (main could be repointed to malicious content between runs). Pin to this PR's own head commit (400691f), which already contains the job-scoped-permissions fix from the prior remediation pass. This satisfies "full commit SHA" now, without waiting on a release tag. Once main has a stable release (v1 / v1.0.0), a follow-up PR can re-pin to that tag for readability -- tracked as a known follow-up, not deferred indefinitely. Co-authored-by: Cursor <cursoragent@cursor.com>

@main

CodeQL init failed (404 via the Contents API) because the reusable workflow's config-file default points at Quantum-L9/Cursor-Governance/.github/codeql/codeql-config.yml@main, and main doesn't have that file yet -- it's introduced by this very PR (bootstrapping problem for a self-referencing caller). Override with a local relative path: this workflow lives in the same repo as the config it needs, and actions/checkout already has it on disk at any ref (PR branch, push, or main), so a local path resolves without hitting the Contents API at all. The org-wide caller template (docs/handoffs/codeql-caller-template.yml) is unaffected -- other repos correctly keep the remote @main reference, which will resolve once this merges. Co-authored-by: Cursor <cursoragent@cursor.com>

cryptoxdog · 2026-07-20T02:20:36Z

Two more fixes (e48ec02, 9f5fb42):

SonarCloud S7637 (failing the Quality Gate): codeql.yml referenced the reusable workflow at @main — a mutable ref, supply-chain risk. Pinned to this PR's own head commit SHA (which already has the job-scoped-permissions fix from the first pass). Once main has a stable release tag, a follow-up PR can re-pin to that tag for readability.
CodeQL init 404: the reusable workflow's config-file default resolves .github/codeql/codeql-config.yml@main via the Contents API — but main doesn't have that file yet (this PR introduces it, so it's a bootstrapping problem for a self-referencing caller). Overrode with a local relative path (./.github/codeql/codeql-config.yml), since this workflow lives in the same repo as the config and actions/checkout already has it on disk at any ref. The org-wide caller template (docs/handoffs/codeql-caller-template.yml) is untouched — other repos correctly keep the remote @main reference, which resolves once this merges.

sonarqubecloud · 2026-07-20T02:21:08Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-advanced-security · 2026-07-20T02:21:44Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

claude added 2 commits July 5, 2026 01:54

cryptoxdog requested a review from Copilot July 5, 2026 02:37

Copilot started reviewing on behalf of cryptoxdog July 5, 2026 02:37 View session

Copilot AI reviewed Jul 5, 2026

View reviewed changes

Comment thread .github/workflows/codeql-reusable.yml

Comment thread .github/workflows/codeql-reusable.yml

Comment thread docs/handoffs/CODEQL_ROLLOUT_HANDOFF.md Outdated

Comment thread docs/handoffs/CODEQL_ROLLOUT_HANDOFF.md Outdated

This was referenced Jul 5, 2026

ci(review): add L9 Copilot code-review instructions + org rollout handoff #4

Merged

governance: make Cursor-Governance the canonical home for ORG_INVARIANTS #5

Merged

cryptoxdog and others added 2 commits July 19, 2026 22:15

cryptoxdog merged commit a41e5e3 into main Jul 20, 2026
5 checks passed

cryptoxdog deleted the claude/l9-ops-mcp-proof-gates-4ak2al branch July 20, 2026 02:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(codeql): centralize CodeQL as a reusable workflow + org rollout handoff#3

ci(codeql): centralize CodeQL as a reusable workflow + org rollout handoff#3
cryptoxdog merged 5 commits into
mainfrom
claude/l9-ops-mcp-proof-gates-4ak2al

cryptoxdog commented Jul 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Jul 20, 2026

Uh oh!

cryptoxdog commented Jul 20, 2026

Uh oh!

cryptoxdog commented Jul 20, 2026

Uh oh!

sonarqubecloud Bot commented Jul 20, 2026

Uh oh!

github-advanced-security AI commented Jul 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

cryptoxdog commented Jul 5, 2026

Summary

What's in this PR

Tuning folded in (reduce friction / increase autonomy)

Guardrails (non-negotiable)

Validation

Rollout (after merge)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Jul 20, 2026

Uh oh!

cryptoxdog commented Jul 20, 2026

Uh oh!

cryptoxdog commented Jul 20, 2026

Uh oh!

sonarqubecloud Bot commented Jul 20, 2026

Quality Gate passed

Uh oh!

github-advanced-security AI commented Jul 20, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants