From bc7531c0307e7ad77f9bf4fb2f07589651052b91 Mon Sep 17 00:00:00 2001
From: ThePrismSystem <10910959+ThePrismSystem@users.noreply.github.com>
Date: Thu, 6 Aug 2026 12:12:12 -0500
Subject: [PATCH] ci: run CodeQL on our runners except for fork pull requests

CodeQL was the one workflow still pinned to ubuntu-latest after the rest of
CI moved to self-hosted. It now uses the same expression every job in ci.yml
carries, so the analysis runs on our hardware for pushes, the weekly cron and
branch pull requests, and falls back to GitHub's for fork pull requests.

build-mode: none parses the tree rather than executing it, so this job never
had ci.yml's arbitrary-code exposure. The guard is here so the trust boundary
is stated in one form across both workflows rather than inferred per file.
---
 .github/workflows/codeql.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3b72070..3b8dee7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,13 @@ concurrency:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-latest
+    # The same trust boundary ci.yml draws: a fork pull request runs on
+    # GitHub's hardware, everything else on ours. `build-mode: none` reads the
+    # tree rather than running it, so the exposure here is smaller than the
+    # build jobs' — but a fork pull request still costs its author nothing, and
+    # the runner still sits on our LAN. On a push to main or the weekly cron
+    # the pull_request context is absent and this falls through to self-hosted.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'self-hosted' }}
     permissions:
       security-events: write
       actions: read