From 5db35a13ac60d4c49e060570d7d4c7308ac20f82 Mon Sep 17 00:00:00 2001
From: Angu Prasad <angu.prasad@gomotive.com>
Date: Wed, 13 May 2026 17:20:31 +0400
Subject: [PATCH 1/3] ci(PRODSEC-343): consolidate CodeQL workflows into single
 unified scan - codeql-full-scan.yml

---
 .github/workflows/codeql-full-scan.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .github/workflows/codeql-full-scan.yml

diff --git a/.github/workflows/codeql-full-scan.yml b/.github/workflows/codeql-full-scan.yml
new file mode 100644
index 0000000..6826299
--- /dev/null
+++ b/.github/workflows/codeql-full-scan.yml
@@ -0,0 +1,23 @@
+name: "CodeQL Full Scan"
+
+on:
+  schedule:
+    - cron: '0 1 * * *'  # Daily at 01:00 UTC — adjust as needed
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch or tag to scan (leave empty for default branch)'
+        required: false
+        default: ''
+
+jobs:
+  codeql-full:
+    uses: KeepTruckin/security-scanners/.github/workflows/codeql-full-scan.yml@master
+    with:
+      ref: ${{ inputs.ref || '' }}
+    secrets: inherit
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+      packages: read

From f113b5ff0a16fce1cb04fc5b0653ebe8ae31e222 Mon Sep 17 00:00:00 2001
From: Angu Prasad <angu.prasad@gomotive.com>
Date: Wed, 13 May 2026 17:20:33 +0400
Subject: [PATCH 2/3] ci(PRODSEC-343): consolidate CodeQL workflows into single
 unified scan - codeql-pr-scan.yml

---
 .github/workflows/codeql-pr-scan.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/codeql-pr-scan.yml

diff --git a/.github/workflows/codeql-pr-scan.yml b/.github/workflows/codeql-pr-scan.yml
new file mode 100644
index 0000000..637c144
--- /dev/null
+++ b/.github/workflows/codeql-pr-scan.yml
@@ -0,0 +1,21 @@
+name: "CodeQL PR Scan"
+
+on:
+  pull_request:
+    types: [opened, reopened, ready_for_review, synchronize]
+    # branches: [master, main]
+
+jobs:
+  codeql-pr:
+    # Skip draft PRs. Event coverage:
+    #   opened/reopened  — scans PRs immediately on creation (non-draft only, draft guard applies)
+    #   ready_for_review — fires on draft→ready transition (always non-draft, guard is belt-and-suspenders)
+    #   synchronize      — fires on every new push, including to drafts (guard prevents those)
+    if: ${{ !github.event.pull_request.draft }}
+    uses: KeepTruckin/security-scanners/.github/workflows/codeql-pr-scan.yml@master
+    secrets: inherit
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+      packages: read

From fb60d7496a8893a82298140121b8fe8d071143fa Mon Sep 17 00:00:00 2001
From: Angu Prasad <angu.prasad@gomotive.com>
Date: Wed, 13 May 2026 17:20:35 +0400
Subject: [PATCH 3/3] ci(PRODSEC-343): consolidate CodeQL workflows into single
 unified scan - codeql.yml

---
 .github/workflows/codeql.yml | 37 ++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..9eebe52
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,37 @@
+name: "CodeQL"
+
+on:
+  schedule:
+    - cron: '0 1 * * *'  # Daily at 01:00 UTC
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch or tag to scan (leave empty for default branch)'
+        required: false
+        default: ''
+  pull_request:
+    types: [opened, reopened, ready_for_review, synchronize]
+    # branches: [master, main]
+
+# Cancel in-progress PR scans when new commits arrive; never cancel full scans.
+concurrency:
+  group: codeql-unified-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  scan:
+    # Skip draft PRs. Non-PR events are never drafts so this guard is a no-op
+    # for schedule/workflow_dispatch.
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
+    uses: KeepTruckin/security-scanners/.github/workflows/codeql-scan.yml@master
+    with:
+      ref: ${{ inputs.ref || '' }}
+      # Full scans (schedule/dispatch) seed the overlay-base cache for PR scans.
+      # PR scans restore it read-only — they must NOT overwrite it.
+      save-cache: ${{ github.event_name != 'pull_request' }}
+    secrets: inherit
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+      packages: read