[vincentkoc]

Main pushes repeat CodeQL work in this quiet repository. Batch full Actions and JavaScript/TypeScript default analysis weekly on Mondays at 05:37 UTC while retaining PR/manual scans. Scheduled scans do not cancel running scans; only superseded PR scans cancel. The one-line root .ci-policy.md and changelog explain why.

Existing PR validation and serialized main deployment remain unchanged. A normal main merge may invoke the existing released-vocabulary publisher and deployment. The publisher commits only its two vocabulary files, preserving this workflow. Preserve attached security configuration 268171, which allows advanced scanning.

Repository maintainers own explicit language-matrix additions, pinned action updates and checking/re-enabling scheduled Actions after 60 days of repository inactivity. Scheduled results do not guarantee exact release-SHA security proof.

Validation: actionlint, diff checks and independent source/contract review passed. Full-context P0–P3 autoreview raised one P2 requesting the ownership handoff. Independent review resolved it through the explicit handoff below and the central infra/maintainer runbook, keeping the requested repository rationale one line. At bcd5713bdec3d25d5b5797c0c3d534c6364e3037, default scans 41636788394 passed and candidate 41636794585 completed 17 Actions and 85 JavaScript security queries; its only processing failures were expected default ownership rejection. Native check41636794622 fails the existing release-vocabulary gate: released OpenClaw revision 7dc3350cb9f08fcf9a0af5c4845a20d5b2f1a8be has no retained snapshot. This PR remains draft and default scanning remains enabled. Unblock: the existing daily 03:17 UTC producer refreshes vocabulary, then update this branch and rerun exact-head native checks; do not bypass the gate or manually change product data for this migration. Default setup stays enabled; advanced SARIF processing rejection is expected and is not a successful scan.

Handoff: require existing CI, successful default PR analyses and completed candidate extraction/security queries before normal source merge. Capture default settings, all alert IDs/states/configurations and existing analysis history. Then disable default setup and dispatch a full main analysis, verifying all languages are processed and alert continuity within 20 minutes; otherwise restore captured default setup and verify rollback. No ownership cutover has happened yet.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR adds weekly CodeQL analysis of main while retaining pull-request and manual scans.

Example: A change merges into main on Tuesday.

• Before: GitHub default setup runs another CodeQL analysis for the main push.
• After: After the documented ownership cutover, main is analyzed on Monday at 05:37 UTC or by manual dispatch.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, maintainer-directed workflow with actual Actions execution and no identified code defect; the draft and recorded cutover remain operational landing conditions.
Proof confidence	🐚 platinum hermit (4/6)	This maintainer-authored PR is outside the ordinary contributor proof gate; actual GitHub Actions runs exercise the candidate workflow, while annotations confirm expected rejection under default setup and the body records the subsequent cutover verification.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Main pushes repeat security-analysis work in a quiet repository.
Reason: The maintainer author supplies the direction and explicitly accepts delayed main coverage, manual language maintenance, and the staged ownership handoff.

Merge readiness

⛔ Blocked before merge - 1 item remains

Keep this maintainer-authored draft open: the workflow is coherent, but native CI and the recorded scanning handoff remain pending; no concrete code defect was found.

Priority: P3
Reviewed head: bcd5713bdec3d25d5b5797c0c3d534c6364e3037

Before merge

• Await maintainer action - After native CI clears and source merge is authorized, the repository maintainer must perform the recorded settings capture, default-setup cutover, full main scan, and alert-continuity or rollback verification.

Findings

None.

Tests

• Missing end-to-end proof: Successful advanced SARIF processing and alert continuity remain the documented post-merge cutover verification.

Agent review details

How this fits together

GitHub Actions checks repository source with the Actions and JavaScript/TypeScript CodeQL analyzers and submits results to GitHub code scanning, separately from Worker deployment.

flowchart TD
  A[Pull request] --> D[CodeQL workflow]
  B[Monday schedule] --> D
  C[Manual dispatch] --> D
  D --> E[Actions and JavaScript analysis]
  E --> F[GitHub code scanning]
  G[Main deployment workflow] --> H[Cloudflare Worker]

Loading

Technical review

Best possible solution:

Land the focused workflow after native CI clears, then complete the documented scanning handoff with alert-continuity verification and rollback available.

Do we have a high-confidence way to reproduce the issue?

This is an operational cadence change rather than a reported product bug; GitHub confirms that current main receives default push scans.

Is this the best way to solve the issue?

A small advanced CodeQL workflow provides the requested schedule while preserving PR analysis and existing deployment ownership.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against df7a20646434.

Provenance checked

• CodeQL scan cadence and ownership changes intended behavior with a stated reason (unknown: Current main uses GitHub-managed default scanning; local workflow history contains no earlier CodeQL workflow, and the configuration API was inaccessible.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced change: The pinned introduction adds only the CodeQL workflow, a one-line policy explanation, and a changelog entry; the verified test merge contains those same changes. (.github/workflows/codeql.yml:3, bcd5713bdec3)
• Maintainer direction and staged handoff: The MEMBER-authored PR remains draft and explicitly retains default setup until source merge, followed by settings capture, a full main scan, alert-continuity verification, and rollback if verification fails: fix(ci): batch main CodeQL scans weekly #33. (bcd5713bdec3)
• Actual candidate execution: The candidate ran through GitHub Actions at the reviewed head. Both initialization steps succeeded, and both analysis jobs report that advanced SARIF cannot be processed while default setup is enabled; the separate default scan passed: https://github.com/openclaw/telemetry/actions/runs/41636794585 and https://github.com/openclaw/telemetry/actions/runs/41636788394. (.github/workflows/codeql.yml:43, bcd5713bdec3)
• Native CI attribution: Native CI passed npm run check, then failed the latest-release vocabulary gate and skipped the dry-run build. The gate, generator, and both vocabulary files have identical blobs on main and this PR, so this diff introduces no change to that failing path: https://github.com/openclaw/telemetry/actions/runs/41636794622. (.github/workflows/deploy.yml:108, bcd5713bdec3)
• Feature history: Workflow history identifies Vincent Koc's permission restriction and vocabulary-maintenance work, Josh Avant's runtime pinning, and Peter Steinberger's original workflow and PR-validation work. The existing publication and deployment boundary is documented in feat(telemetry): maintain public vocabulary from stable releases #29. (.github/workflows/deploy.yml:10, df7a20646434)
• Policy and inspection limits: No AGENTS.md, maintainer-notes directory, or pr-simplify skill exists in the checkout. Some historical blobs were unavailable locally; REST commit patches supplied the relevant ownership evidence. Log downloads were blocked by the proxy, and security-setting endpoints returned 403, so query counts and attached configuration details remain author-reported. (bcd5713bdec3)

Labels

Label changes:

• add P3: This is a maintainer-directed CI efficiency change with no demonstrated broken user workflow.
• add merge-risk: 🚨 automation: The workflow changes security-scan cadence and ownership; the maintainer explicitly accepts weekly main coverage and records a staged cutover with rollback.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on maintainer: Only explicit maintainer approvals or decisions remain; merge is still blocked.

Label justifications:

• P3: This is a maintainer-directed CI efficiency change with no demonstrated broken user workflow.
• merge-risk: 🚨 automation: The workflow changes security-scan cadence and ownership; the maintainer explicitly accepts weekly main coverage and records a staged cutover with rollback.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on maintainer: Only explicit maintainer approvals or decisions remain; merge is still blocked.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 3, 2026, 7:52 AM ET / 12:52 UTC.