improvement(ci): run the CodeQL cron weekly and cancel superseded scans

[waleedlatif1]

Summary

• CodeQL cron goes daily -> weekly (Mondays). Main is already fully scanned on every merge (~2/day), so a nightly run re-scanned a tree that was scanned hours earlier at ~50 runner-minutes each. Every upstream repo that pairs a cron with push+PR triggers uses a weekly cron (TypeScript, codeql-action, immich, novu, nestjs, langflow), and GitHub's starter workflow ships $cron-weekly. Daily crons upstream belong to repos where the cron is the only trigger.
• cancel-in-progress is now unconditional instead of PR-only. Main pushes were serializing: run 31089722455 finished at 11:29:21 and the next run's jobs were created at exactly 11:29:21, so a merge sat queued ~31 min before its ~50 min scan even started. Only the newest analysis of a ref feeds the alert view, so superseded runs are safe to drop. Upstream repos that set concurrency at all use a plain true.

Kept the push: [main] trigger — it's what the PR scans diff against, and dropping it would degrade the PR analyses, not just staleten the dashboard. Left the PR-side paths filter alone.

Type of Change

• Improvement

Testing

Verified the YAML parses and the triggers resolve as intended (push: [main], pull_request: [main, staging] with the paths filter intact, single weekly cron, cancel-in-progress: true). Trigger behavior itself only exercises once this is on the default branch.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 8, 2026 5:04am

[cursor]

PR Summary

Low Risk
CI workflow-only changes with no application code; slightly less frequent scheduled scans on quiet main, offset by push-on-merge coverage.

Overview
CodeQL scheduling and concurrency in .github/workflows/codeql.yml are tuned to cut redundant runner time while keeping push/PR coverage unchanged.

The scheduled scan moves from daily (17 8 * * *) to weekly on Mondays (17 8 * * 1), as a safety net when main is quiet; merges already trigger full scans on push.

Concurrency now sets cancel-in-progress: true for all events (not only pull requests), so newer runs on the same ref replace in-flight ones instead of queuing behind long main scans. Push to main, PR triggers, and path filters are unchanged.

^{Reviewed by Cursor Bugbot for commit fb8f639. Configure here.}

[greptile-apps]

Greptile Summary

The PR reduces scheduled CodeQL scans from daily to weekly and allows newer runs on the same ref to cancel superseded scans.

• Changes the CodeQL cron schedule to Mondays.
• Makes cancel-in-progress unconditional.
• Removes the obsolete comment describing the previous cancellation behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/codeql.yml	Updates CodeQL scheduling and concurrency behavior; the previously flagged comments have been removed and no related defect remains.

_{Reviews (2): Last reviewed commit: "improvement(ci): run the CodeQL cron wee..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fb8f639. Configure here.}