[botandbang]

What and why

#353 runs every CodeQL language on every pull request, merge queue group and push, because the code scanning rule holds a commit until it has a result in every category main has. Rust's analysis takes 15 to 19 minutes on Linux, even for a pull request that changes no Rust. This gives each category its result without that run when nothing CodeQL reads for that language changed.

• Added: codeql_rust and codeql_javascript filters in ci.yml's changes job. Each covers what CodeQL extracts for that language without a build, plus .github/codeql/** and codeql.yml, which pins the action and so the queries. The scope step outputs codeql_unchanged (the languages neither filter matched, ignoring all) and codeql_base (the commit a push or merge queue group was diffed against, from last-passed).
• Changed: codeql.yml takes unchanged and base. A language in unchanged looks for main's CodeQL analysis of the base commit in its category: for a pull request, the merge commit's first parent. If one exists, the job uploads that SARIF for this commit with upload-sarif, in about a minute, and skips init and analyze. If not, it analyses as before. That happens when main's push run hasn't analysed the base yet, or a push has no passed run to diff against. The matrix still lists every language, which ci: analyse every CodeQL language on every pull request, group and push #353's policy checks.
• Added: a policy in tools/policy/workflows.rego. Every codeql_* filter has to cover .github/codeql/codeql-config.yml and codeql.yml, so a config or action change analyses again. It has tests.
• Updated .github/CONTRIBUTING.md and .github/NEW_PROJECT.md.

The reused results are accurate: with no change to that language's files, its code at this commit is the same as at the base commit main analysed.

How it was tested

• tools/policy.sh: 87/87 Rego tests at full coverage, 52/52 conftest checks. The new rule's two tests fail when the rule is broken on purpose.
• actionlint (with shellcheck) and zizmor --offline are clean.
• The lookup, run against the real API: it finds main's Rust and TypeScript analyses of ecb994a (2072548339 and 2072518287), and nothing for an unknown commit, which falls back to analysing. Main's SARIF keeps CodeQL as its tool and /language:rust/ as its category.
• The scope step, run locally: a web-only pull request reuses Rust, a Rust one reuses TypeScript, a change only to ci.yml reuses both, a change to codeql.yml reuses neither, a push or group with a passed base reuses what it didn't change, and a push without one reuses nothing.
• Only shows on GitHub: that the code scanning rule accepts a category whose result was uploaded this way. This pull request changes codeql.yml, so its own run analyses everything. The first pull request after it that leaves Rust alone exercises the reuse path. If its queue entry then waits on "Code scanning is still expecting 1 result", reverting this restores ci: analyse every CodeQL language on every pull request, group and push #353's behaviour.

Checklist

• Tests cover the change (the policy; the workflows only run on GitHub)
• The READMEs, docs/ and --help still say what the code does

[github-actions]

Coverage Report for apps/web

Status	Category	Percentage	Covered / Total
🟢	Lines	95.55% (🎯 93%) 🟰 ±0 pp	8315 / 8702
🟢	Statements	94% (🎯 91%) 🟰 ±0 pp	12662 / 13469
🟢	Functions	94.3% (🎯 92%) 🟰 ±0 pp	3395 / 3600
🟢	Branches	84.87% (🎯 80%) 🟰 ±0 pp	5890 / 6940

File Coverage

No changed files found.

Generated in workflow #103 for commit fae8ee7 by the Vitest Coverage Report Action

Size

Compared with main. KiB are 1,024 bytes.

	This pull request	main	Change
Client JavaScript	715.2 KiB	715.2 KiB	0 B (0%)
Client JavaScript, brotli	240.3 KiB	240.3 KiB	0 B (0%)
Client CSS	90.2 KiB	90.2 KiB	0 B (0%)
Client CSS, brotli	13 KiB	13 KiB	0 B (0%)

[github-actions]

Coverage Report for apps/localtoolbox

Status	Category	Percentage	Covered / Total
🟢	Lines	100% (🎯 100%) 🟰 ±0 pp	4303 / 4303
🟢	Statements	99.64% (🎯 95%) 🟰 ±0 pp	5862 / 5883
🟢	Functions	99.65% (🎯 95%) 🟰 ±0 pp	1715 / 1721
🟢	Branches	97.72% (🎯 50%) 🟰 ±0 pp	2791 / 2856

File Coverage

No changed files found.

Generated in workflow #103 for commit fae8ee7 by the Vitest Coverage Report Action

Size

Compared with main. KiB are 1,024 bytes.

	This pull request	main	Change
Packaged (localtoolbox.zip)	366.1 KiB	366.1 KiB	-1 B (-0%)
Unpacked (dist/)	842.8 KiB	842.8 KiB	0 B (0%)

[github-actions]

Rust coverage

From run 103. Both are held to the thresholds in .cargo/config.toml.

Tests	Lines	Functions	Regions
All	97.37% (86002/88321)	96.47% (13870/14378)	95.63% (189584/198245)
Hegel property tests alone	95.4% (84259/88321)	94.01% (13517/14378)	93.48% (185319/198245)