ci: T9082: onboard CodeQL scanning

[andamasov]

Adds a thin caller of the central CodeQL reusable workflow (vyos/.github codeql-analysis.yml) — push/PR on rolling + weekly cron, c-cpp. Advisory only; not a required check.

Canary PR for the vyos-org CodeQL rollout (T9082, IS-610) — validates vyos/.github#155 pre-merge via a 3-commit sequence pinned to the Track-A feature SHA:

1. legacy autobuild path on codeql-action v4 (this commit);
2. deliberate invalid input combo — validation step must fail fast;
3. final shape (build-mode: none), coverage compared against run 1.

Pin flips to @production before merge, after vyos/.github#155 lands.

Advances: IS-610

🤖 Generated by robots

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 5f5937f3-a45f-4d4d-b88a-274b68ed7a3a

📥 Commits

Reviewing files that changed from the base of the PR and between d8ba8e1 and bdc5287.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• ansible/ansible (manual)

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Mergify Merge Protections
• GitHub Check: Summary

🧰 Additional context used

📓 Path-based instructions (1)

.github/workflows/**

⚙️ CodeRabbit configuration file

.github/workflows/**: Rollout 1c (Phorge T8943, 2026-05-30) renamed default branches fleet-wide: release-train repos current -> rolling; vyos/.github and other non-release-train repos current -> production. (1) Reusable-workflow refs of the form vyos/.github/.github/workflows/<name>.yml@production are CORRECT and canonical. Do NOT suggest changing @production to @current: current is the OLD name, retained only as a temporary bake-period alias and slated for removal. Any AGENTS.md still saying "reusables pinned to @current" or "current (rolling)" is stale post-1c and must not drive review suggestions. (2) In the mirror caller pr-mirror-repo-sync.yml, permissions: contents: read is INTENTIONAL: the central reusable workflow performs all push/PR writes with the vyos-bot GitHub App installation token (minted via the get-token action), not the inherited GITHUB_TOKEN. Do NOT suggest broadening the caller's permissions to contents: write / pull-requests: write.

Files:

• .github/workflows/codeql.yml

🔍 Remote MCP Context7

Relevant review context from GitHub Actions docs:

• A reusable-workflow job can call another workflow via jobs.<job_id>.uses; for external repos, the ref may be a SHA, tag, or branch, but GitHub says a commit SHA is the safest option for stability/security. So @production is valid, but it is mutable.
• For reusable-workflow callers, permissions on the calling job apply to the called workflow; the callee cannot elevate GITHUB_TOKEN permissions, only downgrade them. That makes the caller’s minimal permissions setting the key control point here.
• schedule uses POSIX cron, runs in UTC by default, and runs on the latest commit of the default branch; GitHub also notes scheduled runs can be delayed during high load. The cron 28 13 * * 0 is therefore a Sunday 13:28 UTC schedule.

🔇 Additional comments (1)

.github/workflows/codeql.yml (1)

1-32: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Added automated CodeQL security analysis for C/C++ code.
  • Analysis runs on relevant changes to the rolling branch and weekly on a scheduled basis.
  • Excludes documentation and workflow-only changes from analysis.

Walkthrough

Adds a GitHub Actions workflow that runs shared CodeQL analysis for C/C++ on rolling-branch pushes, pull requests, and a weekly schedule, with scoped permissions and path exclusions.

Changes

CodeQL analysis

Layer / File(s)	Summary
Workflow integration .github/workflows/codeql.yml	Adds push, pull-request, and weekly scheduled triggers; scopes workflow permissions; and invokes the shared CodeQL workflow for C/C++ with build-mode: none (lines 1–31).

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: onboarding CodeQL scanning for the repo.
Description check	✅ Passed	The description is clearly aligned with the workflow change and its canary rollout purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feature/T9082-codeql-onboard

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[andamasov]

Adversarial review — bdc5287aa60b4b7ddcfb1c767d73f151e4797d00 — Codex + agy parallel

NO FINDINGS (both providers). Trigger correctness, permissions minimality, language/build-mode validity, and fleet-template conformance verified independently by both reviewers.

---

Each finding must receive a fix commit OR a pushback reply in a reply to this comment before merge. See /audit-pr-threads for resolution mechanics.

[sever-sever]

Add PRs CodeQL Analysis

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request