Restores the weekly scan coverage previously provided by Default Setup,
so CodeQL analysis still runs when no CI triggers land on main.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Remove the direct push-on-main trigger from security-codeql.yml so that
the concurrency group no longer cancels the orchestrator-invoked scan.
CodeQL now runs exactly once per CI run via ci-orchestrator.yml, and
its failure continues to block code-quality-gate and all downstream
deploy, install, and environment tests.
Split the CI documentation along SPOT lines: workflows.md owns the
per-workflow catalog (trigger, inputs, short description); pipeline.md
owns the flow (stages, gates, concurrency, fork handling). Drop the
duplicated entry-points table and per-stage workflow bullet lists from
pipeline.md in favour of cross-references. Fix the stale "push to
latest" wording that pre-dated the current branch prefix list.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Opts out of the April 2026 default change that skips file coverage
computation on PRs by setting CODEQL_ACTION_FILE_COVERAGE_ON_PRS=true.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CodeQL results only appear on the Security tab when the workflow is
triggered by a push event directly. Adds push trigger on main alongside
the existing workflow_call (double run on main push is harmless).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add explicit job names where missing
- Standardize all job titles to Emoji + imperative + object format
- Improve CI readability and consistency across workflows
- No functional changes to job logic or execution order
https://chatgpt.com/share/6988695a-be4c-800f-85ba-5e67e5fef3e0
- Add reusable code-analyses workflow (workflow_call + dispatch)
- Split CI triggers into push, PR, schedule, and version orchestrators
- Remove duplicate triggers from reusable workflows
- Rename and align workflows for clearer CI structure
https://chatgpt.com/share/6943b12d-2c84-800f-b63d-68e4d1db6d0a
- Convert Hadolint and CodeQL workflows to reusable workflow_call
- Keep scheduled scans for Dockerfile hygiene and security analysis
- Integrate lint-docker and security-codeql into mark-stable gate
- Rename workflows for consistent lint/security naming
https://chatgpt.com/share/6943b12d-2c84-800f-b63d-68e4d1db6d0a
