[samharshe]

Purpose

External-contributor PRs such as #34 pass Python tests but cannot satisfy
Analyze (actions) and Analyze (python): the repository requires these
checks while CodeQL default setup excludes PRs from forks.

Changes

• Add a CodeQL advanced workflow using pull_request for forks and internal
  branches, pushes to master/release/**, a weekly scan, and manual dispatch.
• Preserve the exact required Analyze (actions) / Analyze (python) names.
• Analyze both languages without a project build and upload results.
• Pin actions to full commit SHAs and checkout to the event commit.
• Do not use pull_request_target, repository write permissions, stored
  credentials, secrets, path filters, conditional skips, or fabricated checks.
• Add six workflow regression tests and a migration/recovery checklist at
  docs/codeql-fork-pr-checks.md.

Validation

• python -m pytest -q tests/test_codeql_workflow.py: 6 passed.
• python -m pytest -q: 1,407 passed, 845 subtests passed.
• actionlint 1.7.12: passed for the new workflow.
• git diff --check: passed.
• GitHub Python tests and wheel smoke test: passed.
• Both advanced CodeQL language jobs
  ran analysis, then failed during SARIF processing with the expected message:
  CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled.
• The existing default-setup scans passed; they do not validate this new workflow.
• Successful advanced upload and real fork-PR verification remain pending
  the separately approved settings migration.

Migration gate

This PR does not change repository settings, required checks, or merge any PR.

GitHub rejects advanced CodeQL uploads while default setup is enabled.
The setting is still enabled. An advanced workflow failure before migration
is expected and must not be hidden with a skip or disabled upload.

After review and explicit authorization, a repository administrator must
switch CodeQL from default to advanced setup. Then rerun this PR's
CodeQL advanced jobs and verify uploaded results. Inspect the workflow
identity because default setup uses the same analysis job names.
Merge only after the new workflow and test job pass and merge is authorized.
Update #34 and other external PRs from master, approve contributor runs
where needed, and verify both analysis checks on their current commits.

The draft status makes the remaining migration and validation gates explicit.
No repository settings were changed during preparation.

References

• Default setup excludes fork PRs
• Advanced-setup migration
• Default setup rejects advanced uploads
• CodeQL pull-request upload permissions

[cursor]

Bugbot is paused — your team has an unpaid invoice

Bugbot is paused because your team has an unpaid invoice.

Pay it from the billing page in the Cursor dashboard and Bugbot resumes automatically.

(requestId: 8f8faf7f-5fd5-4acd-9d13-b2ce60def5f1)

[functionstackx]

can u make it that external PRsneed approve before runnign gh actions