From e2c9f92f60287e2c85e4259336598227ad5da507 Mon Sep 17 00:00:00 2001
From: parthrohit22 <parthrohit60@gmail.com>
Date: Sat, 8 Aug 2026 19:20:37 +0100
Subject: [PATCH] fix(security): scan the default branch on push to keep CodeQL
 current

The Code scanning page reported warnings detected in 2 configurations for
both language:javascript-typescript and language:python. Neither was a
finding: there are zero open code scanning alerts. Both configurations were
simply stale, last analysed at 04d8e2b2 on 3 August, 37 commits behind dev.

CodeQL only ran on pull_request and the weekly cron. A pull_request run
analyses refs/pull/N/merge, which never updates the branch's own result, so
dev's analysis could only refresh once a week and drifted between crons.

Add a push trigger for dev and main so the default branch is re-analysed as
work lands. Exempt default-branch runs from cancel-in-progress: that result
is what the Security tab reports, and cancelling it during a run of merges
would leave it stale again. PR and push runs use distinct refs, so they
never cancel each other.

Also corrects the schedule comment, which still claimed the weekly scan
analysed stale main because dev was not yet the default branch. dev is the
default branch now.
---
 .github/workflows/codeql.yml | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 633dd44..c3d73d8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,6 +5,16 @@
 name: CodeQL
 
 on:
+  # Analysing the default branch on every push is what keeps the Security tab
+  # current. Without this, `dev`'s own analysis only refreshed on the weekly
+  # cron, so the Code scanning page reported "warnings detected in 2
+  # configurations" — the scans were 5 days and 37 commits stale, not finding
+  # anything. PR runs analyse a merge ref, which never updates the branch's
+  # own result.
+  push:
+    branches:
+      - dev
+      - main
   pull_request:
     branches:
       - dev
@@ -13,19 +23,26 @@ on:
     # Weekly, Monday 03:17 UTC. Off-the-hour on purpose: GitHub drops scheduled
     # runs when too many land on the same minute.
     #
-    # Note: scheduled workflows only ever run on the DEFAULT branch. Until `dev`
-    # becomes the default (§2.2 / E3.1), this weekly scan analyses stale `main`.
-    # The pull_request trigger above is what actually guards day-to-day work.
+    # Scheduled workflows only ever run on the default branch, which is now
+    # `dev`. This backstop catches newly-published CodeQL queries finding
+    # issues in code that has not changed; the push trigger above is what keeps
+    # results fresh as work lands.
     - cron: '17 3 * * 1'
 
 # Least privilege by default; the analyze job widens only what it needs.
 permissions:
   contents: read
 
-# A newer push to the same PR makes an in-flight scan irrelevant.
+# A newer push to the same PR makes an in-flight scan irrelevant. Keyed on the
+# ref, so a push run on `dev` (refs/heads/dev) and a PR run (refs/pull/N/merge)
+# never cancel each other.
+#
+# Default-branch runs are never cancelled: that result is what the Security tab
+# reports, and cancelling one during a run of merges would leave it stale again
+# — the exact problem the push trigger exists to fix.
 concurrency:
   group: codeql-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.ref != 'refs/heads/dev' && github.ref != 'refs/heads/main' }}
 
 jobs:
   analyze: