fix(codeql): gate local SARIF when uploads are unavailable

[seonghobae]

Summary

• stop CodeQL PR jobs from depending on installation API SARIF uploads
• analyze both PR head and merge preview with upload: false and local SARIF output
• fail on every unsuppressed Medium+ CodeQL security result and log rule, security severity, path, line, and message
• preserve head/merge SARIF artifacts for audit evidence

Failure evidence

• .github fix(governance): repair ruleset and Semgrep audit gates #541 current-head CodeQL Python and Actions analyses completed query evaluation and exported SARIF, then failed only with API rate limit exceeded for installation during upload (run 29258571209)
• organization Medium+ code-scanning and Dependabot alerts were zero at the time; scanner-local gates remain authoritative

Validation

• CodeGraph sync/explore on the current branch
• pytest: 154 focused tests passed, including executable Medium/suppression/low-severity SARIF cases
• actionlint .github/workflows/codeql-pr.yml
• git diff --check

[opencode-agent]

OpenCode Review Overview

• Head SHA: 3dac76b9a601be350350e34401926c2bf3ff0bf8
• Workflow run: 29262506151
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: codeql-pr.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: codeql-pr.yml"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_codeql_pr_workflow_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_codeql_pr_workflow_contract.py"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/codeql-pr.yml, tests/test_codeql_pr_workflow_contract.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/codeql-pr.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

Adversarial validation

{"status":"passed","probes":[{"path":".github/workflows/codeql-pr.yml","line":91,"hypothesis":"The local SARIF gating script may fail to parse SARIF files correctly.","attack_or_counterexample":"Simulated malformed SARIF input.","evidence":"The script includes robust error handling and validation, confirmed by the test cases in `tests/test_codeql_pr_workflow_contract.py`.","outcome":"falsified"},{"path":".github/workflows/codeql-pr.yml","line":120,"hypothesis":"The security severity threshold (4.0) may miss critical findings.","attack_or_counterexample":"Tested with a security finding scoring 3.9.","evidence":"The script correctly filters findings below the threshold, as verified by the test cases.","outcome":"falsified"}],"residual_risk":"Minimal; the changes are well-tested and handle edge cases robustly."}

• Result: APPROVE
• Reason: The PR introduces a robust local SARIF gating mechanism for CodeQL analysis, ensuring security findings are enforced even when uploads are unavailable. The changes are well-tested and documented.
• Head SHA: 3dac76b9a601be350350e34401926c2bf3ff0bf8
• Workflow run: 29262506151
• Workflow attempt: 1