From 706470833db4fe19ed1160a796fd6799c9499852 Mon Sep 17 00:00:00 2001
From: Cailyn Sinclair <choover11@gmail.com>
Date: Mon, 13 Jul 2026 19:59:44 -0700
Subject: [PATCH] Run CodeQL on dev pushes

Validate release candidates with CodeQL on the integration branch and guard the workflow branch list against regressions.
---
 .github/workflows/ci.yml        |  3 +++
 .github/workflows/codeql.yml    |  1 +
 docs/release-workflow.md        |  6 +++---
 scripts/test-codeql-branches.sh | 19 +++++++++++++++++++
 4 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100755 scripts/test-codeql-branches.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1405732..9712e8f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,6 +21,9 @@ jobs:
       - name: Validate CI branch coverage
         run: scripts/test-ci-branches.sh
 
+      - name: Validate CodeQL branch coverage
+        run: scripts/test-codeql-branches.sh
+
   server:
     name: Server lint and unit tests
     runs-on: ubuntu-latest
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 700b698..c674c56 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -4,6 +4,7 @@ on:
   pull_request:
   push:
     branches:
+      - dev
       - master
   schedule:
     - cron: '23 10 * * 1'
diff --git a/docs/release-workflow.md b/docs/release-workflow.md
index a1304a6..e0cc89a 100644
--- a/docs/release-workflow.md
+++ b/docs/release-workflow.md
@@ -9,7 +9,7 @@ Production deployment remains a separately authorized operation described in
 1. Open each focused feature pull request against `dev`.
 2. Review and merge the feature into `dev`.
 3. Treat the resulting `dev` merge commit as the release candidate. Its push
-   CI run must finish before promotion is considered.
+   CI and CodeQL push runs must finish before promotion is considered.
 4. Open a reviewed promotion from that exact `dev` commit to `master`.
 5. After the promotion is merged and its `master` push CI passes, perform the
    separately authorized deployment procedure.
@@ -22,8 +22,8 @@ on `dev` after release-candidate validation requires a new validation run.
 Before approving a `dev` to `master` promotion, record or link the following in
 the promotion pull request:
 
-- the exact `dev` commit SHA and its successful CI run, including Cypress for
-  full-stack changes;
+- the exact `dev` commit SHA and its successful CI and CodeQL push runs,
+  including Cypress for full-stack changes;
 - the review that approved the promotion and any issue or milestone links;
 - focused and broad checks relevant to the change, including checks not run;
 - schema migration compatibility and data-backfill evidence when persistence
diff --git a/scripts/test-codeql-branches.sh b/scripts/test-codeql-branches.sh
new file mode 100755
index 0000000..8aa4e06
--- /dev/null
+++ b/scripts/test-codeql-branches.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+WORKFLOW="$SCRIPT_DIR/../.github/workflows/codeql.yml"
+
+for branch in dev master; do
+  if ! awk '
+    /^  push:/ { in_push = 1; next }
+    in_push && /^  [^[:space:]]/ { exit }
+    in_push && $0 == "      - " branch { found = 1 }
+    END { exit !found }
+  ' branch="$branch" "$WORKFLOW"; then
+    echo "CodeQL must run on pushes to $branch." >&2
+    exit 1
+  fi
+done
+
+echo "CodeQL push branch coverage checks passed."