ci(codeql): add weekly + push CodeQL JS/TS scan#133
Merged
Conversation
Owner
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Coverage report
Floors live in |
size-limit report 📦
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This was referenced Apr 26, 2026
Luis85
added a commit
that referenced
this pull request
Apr 26, 2026
## Summary Update `feedback_autonomous_merge_after_codex.md` to reflect two operational shifts already in practice: - **Project switched to squash-merge** post-PR #119. Every PR from #133 onward lands as a squash commit (`<type>: <subject> (#NNN)`). Previous `gh pr merge <n> --merge --delete-branch` recipe returns `enablePullRequestAutoMerge` GraphQL error. - **Post-squash topic branches need `-D`** for cleanup. The squash creates a NEW commit SHA, so the local topic branch is no longer an ancestor of develop and `git branch -d <topic>` fails. Also documents the `--auto` flag for cases where `gh pr merge` is fired while required checks are still mid-run. ## Files changed - `.claude/memory/feedback_autonomous_merge_after_codex.md` — `--merge` → `--squash`, `-d` → `-D`, plus the `--auto` note. ## Test plan - [x] `npm run verify` green locally (format:check + lint + typecheck + 588 tests + build + typedoc) - [x] No `src/**` changes — memory-doc only - [x] No changeset (per `CLAUDE.md`: docs/refactor/chore PRs skip changesets) ## Notes for review - This recipe was used end-to-end on PR #149 a few minutes before this PR — `--squash --delete-branch` with `--auto`-equivalent timing worked clean. - Rule violation flagged: this is a second PR opened in the same Claude session as #149. Owner explicitly requested it after #149 landed; cited as override of the new one-PR-per-session rule for a trivial single-file memory doc update.
Luis85
added
the
roadmap:quality-baseline
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tracks: #130
Tracks: #131
Summary
Adds a CodeQL JS/TS scan that runs on every push and PR to develop/main
plus a Mondays-06:00-UTC weekly cron, using the
security-and-qualityquery suite. All actions pinned to 40-char commit SHAs per the repo's
supply-chain rule.
Ticks row 1 of the umbrella tracker.
Test plan
npm run verifygreen (523/523 tests, lint/typecheck/build all pass)actionlintclean on.github/workflows/codeql.ymlresolve_action_shapeel-aware helper (annotated tags handled)CodeQL / Analyze (javascript-typescript)job runs green on the merge push todevelop