docs(plan): define evaluation platform evolution #226

	name: CodeQL

	# Security scanning ONLY (security-extended query suite — no quality/maintainability
	# queries). Free on public repos.
	#
	# The counterpart this comment used to name (CodeRabbit) is retired, and as of
	# 2026-07-22 NO AI reviewer runs on this repo — Gemini Code Assist is sunset and
	# Greptile is dark. CodeQL owns security; correctness and design review is the
	# repo's own CI (partner-name guard, spec-drift gates, projection freshness,
	# vendor-meta provenance, scripts/tests) plus human review.

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "27 3 * * 1"

	permissions:
	contents: read
	security-events: write
	actions: read

	concurrency:
	group: codeql-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	runs-on: ubuntu-latest
	timeout-minutes: 30
	strategy:
	fail-fast: false
	matrix:
	language: [javascript-typescript, python]
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: ${{ matrix.language }}
	build-mode: none
	queries: security-extended
	# Scopes analysis to code this repo authors and executes. The captured
	# upstream trees are third-party bytes retained as evidence and must
	# never be edited — see .github/codeql-config.yml for the full reasoning.
	config-file: ./.github/codeql-config.yml
	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:${{ matrix.language }}"

Navigation Menu