[90c9474c] Auditor revival: scheduled audit trigger and reactive alert producers (#499)

* [927e64d5] Backend slice: auditor scheduled trigger and reactive alert producers (#496) * [1f2cdb4b] Reactive alert producers at QA-fail and rework (#492) * [1f2cdb4b] feat(services): add auditor-targeted rework alert producers at QA-fail and rework chokepoints * [1f2cdb4b] test(services): fix mypy typing in auditor alert producer unit tests * [1f2cdb4b] docs(backend): document reactive auditor rework alert producers in map and role docs --------- Co-authored-by: Backend Developer 2 <be-dev-2@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> * [5173415f] Scheduled audit trigger, config, and sweep prompt (#493) * [5173415f] Add scheduled audit trigger, interval config, sweep prompt, and focused tests * [5173415f] Allow ROBOCO_AUDIT_INTERVAL_SECONDS=0 to disable scheduled sweeps * [5173415f] docs(audit): document scheduled auditor sweeps and ROBOCO_AUDIT_INTERVAL_SECONDS --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> * [a26c18b9] E2E smoke test for auditor triggers (#495) * [a26c18b9] Add e2e smoke test for auditor scheduled and reactive triggers * [a26c18b9] docs(tests): add e2e smoke test catalog and changelog entry for auditor triggers --------- Co-authored-by: Backend Developer 2 <be-dev-2@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> * [3bc47cdc] Fix _fresh_orchestrator state for auditor trigger e2e tests (#497) * [3bc47cdc] fix(tests): initialize orchestrator state in _fresh_orchestrator helper * [3bc47cdc] docs(changelog): add _fresh_orchestrator test harness fix entry --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> * [8323cd50] Fix e2e smoke regression on assembled cell PR #496 (#498) * [8323cd50] fix(e2e_smoke): repair auditor-trigger smoke tests and harden harness * [8323cd50] docs(tests): document e2e smoke harness hardening for PR #498 --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> --------- Co-authored-by: Backend Developer 2 <be-dev-2@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> * [37e6d999] Backend: repair failing CI checks on auditor revival PR #499 (#503) * [6e79bada] Triage and fix Python quality gate and Analyze (python) failures (#501) * [6e79bada] fix(task): replace type ignore with forward-reference cast for SQLAlchemy Mapped UUID in get_all_descendants * [6e79bada] fix(notification_delivery): add generic type arguments to dict return types in get_ack_status and get_delivery_summary * [6e79bada] docs(changelog): add Python quality gate type-hygiene fixes to Unreleased --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> * [50e7e104] Triage Analyze (javascript-typescript) failure on backend-only diff (#500) * [50e7e104] Split CodeQL workflow so JS/TS analyzer only runs on panel changes * [50e7e104] docs(backend): document split CodeQL workflow triggers and branch protection notes --------- Co-authored-by: Backend Developer 2 <be-dev-2@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> * [203c426b] Triage and fix e2e lifecycle smoke (scripted agents) failure (#502) * [203c426b] fix(orchestrator): pre-initialize _instances in __new__ so __init__-bypass tests survive _dispatch_audit_work; allow audit_interval_seconds=0; mount /api/notifications in e2e harness * [203c426b] fix(e2e_smoke): restore ROBOCO_AGENT_TOKEN isolation and clarify /api/notifications mount comment * [203c426b] docs(map): document orchestrator __new__ pre-init and e2e harness token isolation for auditor-revival smoke fix --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> * [48cb05c2] Fix remaining e2e lifecycle smoke (scripted agents) failure on auditor-revival PR #503 (#504) * [48cb05c2] Harden AgentOrchestrator __new__ pre-init for auditor dispatch state * [48cb05c2] Document auditor-dispatch pre-init rationale in AgentOrchestrator __new__ * [48cb05c2] docs(orchestrator): extend __new__ pre-init docs for auditor-dispatch state --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> --------- Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> Co-authored-by: Backend Developer 2 <be-dev-2@roboco.tech> * [90c9474c] intake: ambient workspace note + dedupe scope clones by git_url Two intake follow-ups folded into 90c9474c's spec Notes: (a) _resolve_intake_ambient now prepends a workspace note so the intake agent knows its cwd holds clones of every project in the scope (the primary at cwd, siblings alongside under /data/workspaces) and drafts against the real trees via Grep/Glob/Read, not from memory. (b) _clone_intake_scope dedupes slugs by git_url before cloning. A multi-project scope can list several projects pointing at one repo (a monorepo's cell-projects share a git_url); cloning each produced redundant identical workspaces. Mirrors CI-watch's per-git_url dedupe: keep the first slug per non-empty git_url; a project with no/empty git_url is never collapsed onto another so distinct local repos still clone. The dedupe is a pure static helper (_dedupe_slugs_by_git_url) with unit coverage. --------- Co-authored-by: Backend Developer 2 <be-dev-2@roboco.tech> Co-authored-by: Backend Documenter <be-doc@roboco.tech> Co-authored-by: Backend Developer 1 <be-dev-1@roboco.tech> Co-authored-by: Renn F <rennf93@users.noreply.github.com>
2026-08-03 07:23:24 +02:00 · 2026-07-13 15:41:00 +02:00
parent 69271f9e98
commit a3524da5f8
23 changed files with 1296 additions and 34 deletions
@@ -0,0 +1,47 @@
+# CodeQL Workflows
+
+RoboCo uses two separate GitHub Actions workflows to run CodeQL analysis. They were split so that backend-only pull requests do not block on the JavaScript/TypeScript analyzer, and frontend-only pull requests do not wait for the Python analyzer.
+
+## Why the workflows are split
+
+The original `.github/workflows/code-ql.yml` ran both the `python` and `javascript-typescript` analyzers under a single path filter. Any change to `roboco/**`, `agents/**`, `alembic/**`, `scripts/**`, `panel/**`, `pyproject.toml`, or the workflow file itself triggered both analyzers. This caused backend-only PRs to fail when the shared JavaScript/TypeScript analyzer tripped over frontend state that was unrelated to the diff.
+
+The fix separates the analyzers by language and by the code they actually scan.
+
+## Workflow files
+
+| File | Name | Language | Triggers |
+|------|------|----------|----------|
+| `.github/workflows/code-ql.yml` | CodeQL Python | `python` | Changes to `roboco/**`, `agents/**`, `alembic/**`, `scripts/**`, `pyproject.toml`, or `.github/workflows/code-ql.yml` |
+| `.github/workflows/codeql-js-ts.yml` | CodeQL JavaScript/TypeScript | `javascript-typescript` | Changes to `panel/**` or `.github/workflows/codeql-js-ts.yml` |
+
+Both workflows also run:
+
+- On a weekly schedule (`0 0 * * 1`).
+- On `workflow_dispatch`.
+
+## Job names
+
+The visible job names are intentionally unchanged:
+
+- `Analyze (python)`
+- `Analyze (javascript-typescript)`
+
+This preserves existing branch-protection rules and PR check expectations. Only the workflow display names changed:
+
+- `CodeQL` → `CodeQL Python`
+- New workflow: `CodeQL JavaScript/TypeScript`
+
+## Concurrency
+
+Each workflow uses a shared concurrency group keyed by `github.workflow` plus either `github.head_ref` (for `pull_request`) or `github.ref_name` (for `push`). This collapses duplicate `push` and `pull_request` runs for the same branch and cancels the older one.
+
+`github.ref` is intentionally not used here because it differs between event types (`refs/pull/<n>/merge` vs `refs/heads/<branch>`), so it would never deduplicate the two event shapes.
+
+## Branch protection
+
+If any branch-protection rule matched the old workflow by its display name (`CodeQL`), update the rule to match by the individual job names (`Analyze (python)` and `Analyze (javascript-typescript)`) rather than the workflow name. The job names did not change.
+
+## When both workflows run
+
+A PR that touches both backend and frontend files (for example, `roboco/**` and `panel/**`) will trigger both workflows, as intended.