chore(security): document that the CodeQL job name gates merges to main

[lskramarov]

Analyze is now a required status check on main, so the job name in codeql.yml is part of the
merge gate rather than a cosmetic label. This adds a comment saying so, next to the name it protects.

Why

The last open code scanning alert (#26)
is OpenSSF Scorecard's SAST check, not a code vulnerability — it has no file attached:

score is 9: SAST tool detected but not run on all commits:
Warn: 23 commits out of 29 are checked with a SAST tool

Scorecard reads the last 30 commits of the default branch and, for each one that came from a merged
PR, looks for a successful check run from the github-advanced-security app on that PR's head SHA.
All six non-compliant commits are PRs whose heads predate codeql.yml, which landed on main on
2026-08-11 in 42439d0 (#1877): #1870, #1871, #1872, #1873, #1874 and #1878. Every one of the 23 PRs
merged since then passes, Dependabot's included, so the workflow itself needed no change and the
alert clears itself once those six commits fall out of the 30-commit window.

What did need fixing is that main had no required status checks at all, so nothing stopped a PR
from merging with CodeQL failed or skipped. That is not hypothetical: on 2026-08-17 the run on
fix/DS-5407 failed with a transient GitHub-side error while uploading SARIF
(No server is currently available to service your request). Had that PR been merged on that head
SHA, it would have produced a permanently non-compliant commit and re-opened the alert.

Analyze has been added as a required check in branch protection (strict: false, so branches are
not forced to be up to date before merging). This comment records the consequence for whoever edits
the workflow next.

Notes

• Renaming the job renames the check run, and branch protection would then wait forever for a
  context nothing reports.
• A paths: filter would deadlock the same way: a filtered-out workflow creates no check run at all.

[Copilot]

Pull request overview

Documents that the CodeQL workflow’s job name is part of the merge gate, because Analyze is configured as a required status check on main. This helps prevent accidental edits (renames or paths: filtering) that would break branch protection expectations by eliminating/renaming the check run.

Changes:

• Add an inline comment in .github/workflows/codeql.yml explaining that the Analyze job name must remain stable because it gates merges to main.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Visit the preview URL for this PR (updated for commit c41087c):

https://koobiq-next--prs-1912-pl5rz5ay.web.app

_{(expires Fri, 21 Aug 2026 07:07:03 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: c9e37e518febda70d0317d07e8ceb35ac43c534c}