Opts out of the April 2026 default change that skips file coverage
computation on PRs by setting CODEQL_ACTION_FILE_COVERAGE_ON_PRS=true.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CodeQL results only appear on the Security tab when the workflow is
triggered by a push event directly. Adds push trigger on main alongside
the existing workflow_call (double run on main push is harmless).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add explicit job names where missing
- Standardize all job titles to Emoji + imperative + object format
- Improve CI readability and consistency across workflows
- No functional changes to job logic or execution order
https://chatgpt.com/share/6988695a-be4c-800f-85ba-5e67e5fef3e0
- Add reusable code-analyses workflow (workflow_call + dispatch)
- Split CI triggers into push, PR, schedule, and version orchestrators
- Remove duplicate triggers from reusable workflows
- Rename and align workflows for clearer CI structure
https://chatgpt.com/share/6943b12d-2c84-800f-b63d-68e4d1db6d0a
- Convert Hadolint and CodeQL workflows to reusable workflow_call
- Keep scheduled scans for Dockerfile hygiene and security analysis
- Integrate lint-docker and security-codeql into mark-stable gate
- Rename workflows for consistent lint/security naming
https://chatgpt.com/share/6943b12d-2c84-800f-b63d-68e4d1db6d0a