@@ -256,10 +256,10 @@ landed PR is merged and that each duplicate has either a shared referenced issue
256256or overlapping changed hunks.
257257258258The `CodeQL` workflow is intentionally a narrow first-pass security scanner,
259-not the full repository sweep. Daily and manual runs scan Actions workflow code
260-plus the highest-risk JavaScript/TypeScript auth, secrets, sandbox, cron, and
261-gateway surfaces with high-precision security queries under the
262-`/codeql-critical-security/core-auth-secrets` category. The
259+not the full repository sweep. Daily, manual, and non-draft pull request guard
260+runs scan Actions workflow code plus the highest-risk JavaScript/TypeScript
261+auth, secrets, sandbox, cron, and gateway surfaces with high-precision security
262+queries under the `/codeql-critical-security/core-auth-secrets` category. The
263263channel-runtime-boundary job separately scans core channel implementation
264264contracts plus the channel plugin runtime, gateway, Plugin SDK, secrets, and
265265audit touchpoints under the `/codeql-critical-security/channel-runtime-boundary`
@@ -278,6 +278,10 @@ source-loading, public-surface, and Plugin SDK package contract trust surfaces
278278under the `/codeql-critical-security/plugin-trust-boundary` category so plugin
279279supply-chain and runtime-loading signal stays separate from both bundled plugin
280280implementation code and the non-security plugin quality shard.
281+The pull request guard stays light: it only starts for changes under
282+`.github/actions`, `.github/codeql`, `.github/workflows`, `packages`, or `src`,
283+and it runs the same critical-security matrix as the scheduled workflow. Android,
284+macOS, and non-security quality CodeQL stay out of PR defaults.
281285282286The `CodeQL Android Critical Security` workflow is the scheduled Android
283287security shard. It builds the Android app manually for CodeQL on the smallest
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。