improvement(ci): move CodeQL off default setup onto Blacksmith

[waleedlatif1]

CodeQL was running via GitHub Advanced Security default setup — no workflow file, so no control over runner, triggers, or concurrency. Result: PR scans of 30–125 min on a 4-vCPU GitHub-hosted runner, re-running on every push. PR #6183 alone burned six overlapping runs (94/96/100/100/125/93 min).

This replaces it with advanced setup. Default setup has already been disabled — the two cannot both be active.

Changes

• Blacksmith 8-vCPU via the same CI_PROVIDER escape-hatch expression as ci.yml
• cancel-in-progress scoped to pull_request, mirroring ci.yml:31, so push and scheduled scans still run to completion
• Triggers: push to main + PR to main/staging + nightly safety net + workflow_dispatch
• paths filter so doc/config-only PRs skip the run entirely
• paths-ignore config dropping tests/mocks/fixtures: 12,716 → 11,128 extracted files
• languages: [javascript-typescript, actions] — python dropped (7 files in the tree)
• Draft-PR skip, persist-credentials: false, SHA-pinned actions, timeout-minutes: 60

On the language list

Default setup listed javascript, javascript-typescript and typescript. Those are aliases of one extractor (github/codeql-action → src/languages/builtin.json), so it was always a single analysis, not three — the logs show Extracting javascript once. Not a source of the slowness.

Prior art

Modelled on how comparable OSS repos configure this. Notably, none of n8n, cal.com, supabase, twenty, PostHog, medusa, next.js or trigger.dev commit a CodeQL workflow at all. Among those that do:

	Trigger	Runner	Languages	cancel-in-progress
elastic/kibana	PR (paths, non-draft, gated) + nightly	self-hosted	javascript	gated instead
getsentry/sentry	PR (paths, !tests/**) + weekly	ubuntu-latest	js, python	yes
immich-app/immich	push + PR + weekly	ubuntu-latest	js, python	yes
directus/directus	nightly only	ubuntu-latest	javascript	—
prisma/prisma	weekly only	ubuntu-latest	javascript	—
nodejs/node	nightly only	ubuntu-slim	cpp, js, python	—

Kibana is the closest analogue (large TS tree) and solves it the same way: dedicated runner + aggressive paths-ignore.

Not adopted: kibana's CODEQL_EXTRACTOR_JAVASCRIPT_OPTION_SKIP_TYPES: true. It is the largest single speedup available, but a GitHub code search returns 4 hits worldwide (kibana + a fork), it is undocumented, and it weakens type-based taint tracking. Available as an escape hatch if runtimes are still unacceptable.

Verification owed

• Confirm actual runtime on this PR (expectation ~10–20 min, unproven)
• Confirm no SOC2/Vanta control requires the Python language or the previous cadence

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 3, 2026 7:49pm

[cursor]

PR Summary

Low Risk
CI and CodeQL configuration only; no application runtime, auth, or data-path changes. Slightly narrower static analysis surface (excluded tests/fixtures and dropped Python) is intentional for speed, not a production behavior change.

Overview
Replaces GitHub Advanced Security default CodeQL setup with a repo-owned advanced workflow, after default setup was disabled so scans no longer run on a fixed 4-vCPU runner with overlapping PR pushes (30–125 min per run).

The new .github/workflows/codeql.yml runs javascript-typescript and actions on Blacksmith 8-vCPU via the same CI_PROVIDER expression as ci.yml, with PR-only cancel-in-progress, draft PR skip, ready_for_review trigger, path filters for JS/TS and workflow changes, nightly schedule plus workflow_dispatch, SHA-pinned CodeQL actions, and NODE_OPTIONS for heap.

.github/codeql/codeql-config.yml shrinks extraction (tests, mocks, fixtures, e2e, build artifacts, docs content) while avoiding **/test/** globs so a real Next.js API route under a test path stays in scope; Python language coverage is dropped from the matrix.

^{Reviewed by Cursor Bugbot for commit e29086b. Configure here.}

[greptile-apps]

Greptile Summary

The PR replaces GitHub CodeQL default setup with a repository-managed advanced setup using Blacksmith runners and scoped concurrency.

• Adds push, pull-request, nightly, and manual scan triggers.
• Configures JavaScript/TypeScript and GitHub Actions analysis with targeted extraction exclusions.
• Preserves analysis of production routes named test by removing broad test-directory exclusions.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported production-route coverage hole is fixed by removing the broad test-directory exclusions.

Important Files Changed

Filename	Overview
.github/codeql/codeql-config.yml	Adds extraction exclusions while retaining coverage of production routes under directories named test; the previously reported coverage hole is fixed.
.github/workflows/codeql.yml	Adds the advanced CodeQL workflow with Blacksmith runner selection, scoped cancellation, draft handling, pinned actions, and JavaScript/TypeScript plus Actions matrices.

_{Reviews (2): Last reviewed commit: "fix(ci): restore CodeQL coverage of the ..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e29086b. Configure here.}