fix(ci): align CodeQL with actions-only analysis (#41)

* fix(ci): align CodeQL with actions-only analysis

Drop leftover JS/TS path filters and dual query suites that disagreed
with the actions language matrix, and include composite actions paths.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ci): handle empty Pester shard lists in matrix build

Workflow-only changes produced @('') from Resolve-PesterCiShards,
which failed Mandatory [string[]] binding in Get-PesterCiShardMatrix.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bolens

.github/workflows/codeql.yml

@@ -9,104 +9,50 @@ on:
     branches: [ main ]
     paths:
       - '.github/workflows/**'
-      - '**/*.js'
-      - '**/*.ts'
-      - '**/*.mjs'
-      - '**/*.cjs'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
+      - '.github/actions/**'
       - '.github/workflows/codeql.yml'
   pull_request:
     branches: [ main ]
     paths:
       - '.github/workflows/**'
-      - '**/*.js'
-      - '**/*.ts'
-      - '**/*.mjs'
-      - '**/*.cjs'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
+      - '.github/actions/**'
       - '.github/workflows/codeql.yml'
   schedule:
     # Run weekly on Mondays at 2 AM UTC
     - cron: '0 2 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
-      issues: write
       security-events: write
-      pull-requests: write
 
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'actions' ]
+        include:
+          - language: actions
+            build-mode: none
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ matrix.language }}
-        queries: security-extended,security-and-quality
-
-    - name: Perform CodeQL Analysis
-      id: analyze
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: "/language:${{matrix.language}}"
-        upload: true
-
-    - name: Comment PR with CodeQL Results
-      if: github.event_name == 'pull_request' && steps.analyze.outcome == 'success'
-      uses: actions/github-script@v9
-      with:
-        script: |
-          const body = `🔍 **CodeQL Analysis Complete** (${{ matrix.language }})
-          
-          CodeQL analysis has completed successfully. Results are available in the **Security** tab of this PR.
-          
-          **Language Analyzed:** ${{ matrix.language }}
-          **Query Suite:** security-extended, security-and-quality
-          
-          📋 **View Results:**
-          - Check the Security tab above for detailed findings
-          - Review any alerts and address them before merging
-          
-          > **Note:** CodeQL does not natively support PowerShell. This analysis covers GitHub Actions workflows in \`.github/workflows\`.
-          
-          *Analysis performed automatically by CodeQL*`;
-          
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: body
-          });
-
-    - name: Comment PR with CodeQL Errors
-      if: github.event_name == 'pull_request' && steps.analyze.outcome == 'failure'
-      uses: actions/github-script@v9
-      with:
-        script: |
-          const body = `❌ **CodeQL Analysis Failed** (${{ matrix.language }})
-          
-          CodeQL analysis encountered an error. Please check the workflow logs for details.
-          
-          **Language:** ${{ matrix.language }}
-          
-          *Check the workflow run for error details.*`;
-          
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: body
-          });
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          # security-and-quality includes security-extended for Actions workflows
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/test-pester.yml

@@ -57,7 +57,10 @@ jobs:
             }
           }
 
-          $include = @(Get-PesterCiShardMatrix -Shards $shards)
+          # Coerce to [string[]] so empty "no matching shards" stays an empty array
+          # (bare @() / $null can bind as '' and fail Mandatory [string[]]).
+          $shardList = [string[]]@($shards | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+          $include = @(Get-PesterCiShardMatrix -Shards $shardList)
           $any = $include.Count -gt 0
           $matrix = if ($any) {
             @{ include = @($include) } | ConvertTo-Json -Compress -Depth 5

scripts/utils/code-quality/modules/PesterCiShardFilter.psm1

@@ -380,8 +380,9 @@ function Resolve-PesterCiShards {
         })
 
     if ($files.Count -eq 0) {
-        # Unary comma preserves empty [string[]] (bare `return @()` unwraps to $null).
-        return , [string[]]@()
+        # Emit nothing so call-site `@()` is a true empty array (Count 0).
+        # Unary-comma / -NoEnumerate empty [string[]] still becomes @('') under `@()`.
+        return
     }
 
     foreach ($ruleName in $rules.Keys) {
@@ -406,7 +407,7 @@ function Resolve-PesterCiShards {
 
     $ordered = [string[]]@($shards | Sort-Object)
     if ($ordered.Count -eq 0) {
-        return , [string[]]@()
+        return
     }
     return $ordered
 }
@@ -421,14 +422,22 @@ function Get-PesterCiShardMatrix {
     param(
         [Parameter(Mandatory)]
         [AllowEmptyCollection()]
+        [AllowEmptyString()]
+        [AllowNull()]
         [string[]]$Shards
     )
 
     $windowsShards = @(Get-PesterCiWindowsShards)
     $archShards = @(Get-PesterCiArchShards)
     $include = [System.Collections.Generic.List[object]]::new()
 
-    foreach ($shard in ($Shards | Sort-Object -Unique)) {
+    # Empty `@()` / `$null` / `''` can arrive from GHA when no shards match changed paths.
+    $shardNames = @(
+        $Shards |
+            Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+            Sort-Object -Unique
+    )
+    foreach ($shard in $shardNames) {
         # Performance shards are Windows-only (historically flaky / slow on Ubuntu).
         if ($shard -notlike 'performance*') {
             $include.Add([pscustomobject]@{

tests/unit/test-runner/ci/test-runner-pester-ci-shard-filter.tests.ps1

@@ -77,6 +77,19 @@ Describe 'PesterCiShardFilter' {
         $matrix | Where-Object { $_.label -eq 'arch-latest' -and $_.shard -eq 'coverage-smoke' } | Should -Not -BeNullOrEmpty
     }
 
+    It 'Accepts empty or blank shard lists without throwing' {
+        @(Get-PesterCiShardMatrix -Shards @()) | Should -HaveCount 0
+        @(Get-PesterCiShardMatrix -Shards @('')) | Should -HaveCount 0
+        @(Get-PesterCiShardMatrix -Shards $null) | Should -HaveCount 0
+    }
+
+    It 'Returns a true empty array for workflow-only changes with no Pester shards' {
+        $shards = @(Resolve-PesterCiShards -ChangedFiles @('.github/workflows/codeql.yml'))
+        $shards.Count | Should -Be 0
+        @($shards | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) | Should -HaveCount 0
+        @(Get-PesterCiShardMatrix -Shards ([string[]]@($shards))) | Should -HaveCount 0
+    }
+
     It 'Exposes a curated Arch shard set' {
         $arch = Get-PesterCiArchShards
         $arch | Should -Contain 'unit-library'