mirror of
https://github.com/simstudioai/sim.git
synced 2026-08-29 02:27:35 +08:00
Waleed
dca1fd60be
Feature PRs land on staging and are ~90% of PR scan volume (90 of the last 100 PRs target staging, 4 target main). Every one of them is scanned again — against the exact tree being promoted — when the staging->main PR opens, so restricting PR scans to main defers the signal to the promotion boundary rather than dropping it. No ruleset or branch protection requires a CodeQL check, and the alert view is fed by the push-to-main and scheduled analyses, not by PR runs. Deliberately a branch cut rather than an activity-type cut. Dropping `synchronize` would have cut a similar share of runs, but it scans a PR's first commit and never its final state — backwards, since review fixups land in later pushes. The scheduled scan moves from weekly to daily. Pushes to main are rare, so with PR scans limited to main the default-branch alert view leans on the cron more than it used to, and a week is too long to leave it stale. It also reseeds the overlay-base database that PR runs restore from: that cache key embeds the CodeQL bundle version, so a bundle bump invalidates it, and an unused Actions cache is evicted after 7 days. Also records, in codeql-config.yml, why the obvious speed-up is a trap: adding `queries:`/`packs:`/`query-filters:` trips OverlayDisabledReason.NonDefaultQueries and permanently disables overlay analysis, trading a documented up-to-10x win on the extraction phase (~53% of a run) for a few percent off the query phase.