fix(ci): add multi-language CodeQL analysis

[vincentkoc]

What Problem This Solves

Resolves a gap where Crabfleet's GitHub Actions, TypeScript, Go, and Swift code did not share one repository-owned CodeQL workflow with explicit first-party extraction.

Why This Change Was Made

Adds an immutable, least-privilege advanced CodeQL workflow. Actions and JavaScript/TypeScript use buildless analysis, Go uses the repository's go.mod toolchain with CodeQL autobuild, and Swift uses an arm64 package build with scratch data under RUNNER_TEMP. The workflow runs for pull requests, main, a weekly schedule, and manual runs.

The replay is based directly on a394179d28e1c8d5fffe73ba624f5dd116de435f. It intentionally contains no changelog or runtime changes.

User Impact

Maintainers get consistent code-scanning results for all four first-party language categories. There is no runtime, deployment, release, or persistence behavior change.

Evidence

• Head: e073ca175ff847bf3e4828ad4e4658e13c47d6fe (signed)
• Diff: workflow +103, contract test +49, production LOC 0
• actionlint .github/workflows/codeql.yml
• node --test --experimental-strip-types tests/codeql-workflow.test.ts (3 passed)
• pnpm check
• pnpm test (1001 passed)
• pnpm build
• go test ./...
• go vet ./...
• swift build --package-path macos/CrabfleetMac --scratch-path "$RUNNER_TEMP/crabfleet-codeql-swift" --arch arm64
• pnpm macos:test (RoyalVNCKit 121 passed; CrabfleetMac 294 passed; integration gate 7 passed)
• git diff --check a394179d28e1c8d5fffe73ba624f5dd116de435f..HEAD
• Test audit: the narrow contract test independently catches language, build-mode, action-pin, credential, trigger, and Swift extraction drift.
• Sol/high final patch review: clean, confidence 0.96.
• Separate exact-base/head review: trigger assertion applied; no C/C++ category warranted. The suggested changelog entry is skipped because repository policy and this PR's reviewed scope require no changelog. Expanding the single Go category across operating-system build tags would require extra analyses or manual extraction, conflicting with this PR's four-category Go-autobuild contract.
• Exact hosted synthetic merge: bf4eefc40562e021a1775bffba4065823290f3ae, with parents a394179d28e1c8d5fffe73ba624f5dd116de435f and e073ca175ff847bf3e4828ad4e4658e13c47d6fe; tree ba3f081ab1c730b48ad2970f6fb710e8da3dbf00 matches the reviewed head.
• Exact-head hosted gates: Worker CI and all four CodeQL jobs passed.
• CodeQL analyses: Actions 17 rules, Go 34, JavaScript/TypeScript 87, Swift 27; every category reported zero results and no analysis error.
• Extraction proof: Actions extracted repository workflows; JavaScript/TypeScript extracted first-party src/**; Go extracted first-party commands and internals and reported success for its discovered project; Swift compiled the package under RUNNER_TEMP and reported 1,027,896 extracted AST nodes with zero unresolved.
• Fresh ClawSweeper review on e073ca175ff847bf3e4828ad4e4658e13c47d6fe: no findings; its only landing condition was completion of exact-head Swift and Worker checks, which are now green.

Action contracts were checked directly at the pinned revisions: checkout v7.0.1 uses persist-credentials: false; CodeQL v4.37.9 owns autobuild through init and does not require a redundant autobuild action; setup-go v7.0.0 reads go.mod and caches from go.sum.

Before the push, the repository was public, default setup was not-configured, the default branch remained exactly a394179d28e1c8d5fffe73ba624f5dd116de435f, the PR head remained exactly bb242be0ec25ec8b5078d6e80f52a931d7638cae, and no open CodeQL alerts existed. No alert was dismissed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32901124416
• Updated: 2026-08-25T21:28:20.363Z

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 29, 2026, 12:51 AM ET / 04:51 UTC.

ClawSweeper review

What this changes

Adds a pinned GitHub CodeQL workflow for Actions, TypeScript, Go, and Swift, with a contract test for triggers, build modes, pins, and checkout permissions.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

The prior changelog finding is resolved and no introduced correctness defect is evident. This member-authored CI PR remains necessary because its main-branch base has no CodeQL workflow; wait for the in-progress exact-head Swift and Worker checks before landing.

Priority: P3
Reviewed head: e073ca175ff847bf3e4828ad4e4658e13c47d6fe

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The narrowly scoped, pinned workflow and contract test are sound; completion of the remaining exact-head checks is the material landing condition.
Proof confidence	🌊 off-meta tidepool	Not applicable: This member-authored CI-only change has no user-visible runtime path requiring external-contributor proof; GitHub has already recorded successful Actions, Go, and JavaScript/TypeScript analyses, while Swift remains in progress.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This member-authored CI-only change has no user-visible runtime path requiring external-contributor proof; GitHub has already recorded successful Actions, Go, and JavaScript/TypeScript analyses, while Swift remains in progress.
Evidence reviewed	7 items	Introduced workflow: The verified PR delta adds the CodeQL workflow; the current main-base tree does not contain that path, so the requested repository-owned scanning is not already implemented on main. Workflow safety: All three jobs use immutable action SHAs, disable persisted checkout credentials, and use only contents read plus security-events write permissions. Repository language layout: The checked-out tree has TypeScript under src/, Go commands and internals, a Swift package under macos/CrabfleetMac, and GitHub Actions workflows; the four configured categories match those first-party surfaces.
Findings	None	None.
Security	None	None.

How this fits together

GitHub Actions runs repository automation on pull requests, main-branch pushes, schedules, and manual dispatch. This workflow scans the repository’s automation and source languages and uploads results to GitHub code scanning.

flowchart LR
  A[Pull request or main push] --> B[CodeQL workflow]
  C[Weekly or manual trigger] --> B
  B --> D[Language-specific analysis]
  D --> E[GitHub code scanning results]
  E --> F[Maintainer security review]

Loading

Before merge

• Resolve merge risk (P1) - The exact reviewed head still has its Swift CodeQL and Worker checks running; landing before they finish would leave macOS extraction and repository-gate validation unconfirmed.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow coverage	3 jobs, 4 language categories	The added workflow covers Actions, TypeScript, Go, and Swift with language-appropriate CodeQL build modes.
Change size	workflow +103, contract tests +49	The PR is narrowly scoped to one automation workflow and its regression guard.

Merge-risk options

Maintainer options:

1. Complete exact-head validation (recommended)
   Wait for the in-progress Swift CodeQL and Worker checks on e073ca1 before landing.

Technical review

Best possible solution:

Keep the pinned three-job workflow and its contract test, then land after the exact-head Swift and Worker checks succeed.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds repository automation rather than repairing a runtime failure.

Is this the best way to solve the issue?

Yes: a pinned, least-privilege workflow with a focused contract test is a narrow maintainable way to add repository-owned scanning.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a394179d28e1.

Labels

Label justifications:

• P3: This is low-risk security-scanning automation with no runtime or user-facing behavior change.
• merge-risk: 🚨 automation: The PR introduces scheduled and pull-request automation that must complete successfully on the exact reviewed head.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This member-authored CI-only change has no user-visible runtime path requiring external-contributor proof; GitHub has already recorded successful Actions, Go, and JavaScript/TypeScript analyses, while Swift remains in progress.

Evidence

What I checked:

• Introduced workflow: The verified PR delta adds the CodeQL workflow; the current main-base tree does not contain that path, so the requested repository-owned scanning is not already implemented on main. (.github/workflows/codeql.yml:1, e073ca175ff8)
• Workflow safety: All three jobs use immutable action SHAs, disable persisted checkout credentials, and use only contents read plus security-events write permissions. (.github/workflows/codeql.yml:14, e073ca175ff8)
• Repository language layout: The checked-out tree has TypeScript under src/, Go commands and internals, a Swift package under macos/CrabfleetMac, and GitHub Actions workflows; the four configured categories match those first-party surfaces. (macos/CrabfleetMac/Package.swift:1, e073ca175ff8)
• Regression guard: The added contract test covers language/build-mode selection, action pinning, credential persistence, and workflow triggers. (tests/codeql-workflow.test.ts:10, e073ca175ff8)
• Prior finding resolved: The reviewed head contains only the workflow and its test; the prior Unreleased changelog-entry finding no longer applies. (CHANGELOG.md:1, e073ca175ff8)
• Exact-head check state: Actions, Go, JavaScript/TypeScript, dispatch, and CodeQL checks have succeeded; Swift analysis and Worker are still in progress for the reviewed head. (.github/workflows/codeql.yml:77, e073ca175ff8)

Likely related people:

• openclaw/openclaw-secops: CODEOWNERS assigns the workflow directory to this team. (role: declared workflow code owner; confidence: high; files: .github/CODEOWNERS, .github/workflows/codeql.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the Swift CodeQL and Worker checks on the reviewed head to finish successfully.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (7 earlier review cycles)

• reviewed 2026-08-25T19:53:41.029Z sha bb242be :: needs maintainer review before merge. :: none
• reviewed 2026-08-25T23:21:14.609Z sha bb242be :: needs changes before merge. :: [P3] Remove the release-owned changelog entry
• reviewed 2026-08-26T03:13:00.417Z sha bb242be :: found issues before merge. :: [P3] Remove the release-owned changelog entry
• reviewed 2026-08-26T10:04:04.461Z sha bb242be :: found issues before merge. :: [P3] Remove the release-owned changelog entry
• reviewed 2026-08-26T19:35:19.337Z sha bb242be :: found issues before merge. :: [P3] Remove the release-owned changelog entry
• reviewed 2026-08-28T02:49:38.956Z sha bb242be :: needs changes before merge. :: [P3] Remove the non-user-visible changelog entry
• reviewed 2026-08-28T23:01:24.480Z sha bb242be :: needs changes before merge. :: [P3] Remove the non-user-visible changelog entry

[vincentkoc]

@clawsweeper re-review

The branch was replayed from current main at a394179d28e1c8d5fffe73ba624f5dd116de435f. The non-user-visible changelog entry is gone, action pins and checkout credentials were tightened, the Go autobuild is owned by CodeQL init without a redundant autobuild action, Swift scratch data uses RUNNER_TEMP, the workflow contract test was strengthened, and all repository-required local gates pass on e073ca175ff847bf3e4828ad4e4658e13c47d6fe.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.