Files
sim/.github/codeql
Waleed 09eba8a0f9 improvement(ci): move CodeQL off default setup onto Blacksmith (#6219)
* improvement(ci): move CodeQL off default setup onto Blacksmith

Default setup pinned every scan to a 4-vCPU GitHub-hosted runner with no
cancel-in-progress: PR scans ran 30-125 min and re-ran on every push (#6183
burned six overlapping runs). None of that is reachable from the settings UI,
so the config moves into the repo.

- Blacksmith 8-vCPU via the same CI_PROVIDER escape hatch as ci.yml
- cancel-in-progress scoped to pull_request so push/schedule scans finish
- push to main + PR to main/staging + nightly safety net
- paths filter so doc-only PRs skip the run entirely
- paths-ignore config drops tests/mocks/fixtures: 12,716 -> 11,128 files
- languages: javascript-typescript + actions; python dropped (7 files in tree)

Default setup has been disabled; the two cannot both be active.

* fix(ci): restore CodeQL coverage of the data-drain test route

Review round 1.

- Drop the '**/test/**' and '**/tests/**' globs. A `test` directory is a
  routable Next.js path segment, and those globs excluded
  apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts —
  a POST handler that authorizes, decrypts destination credentials and makes
  an outbound request. CodeQL paths-ignore has no `!` negation to carve it
  back out, and the globs only covered 76 of 12,716 files.
- Add `ready_for_review` to the pull_request activity types. It is not a
  default type, so a PR opened as a draft and later marked ready was skipped
  by the draft guard and never rescanned until the next push.
2026-08-03 12:50:58 -07:00
..