ci: prune stale and redundant workflows - #2982

Actionable comments posted: 1

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/update-releasenotes.yaml:
- Around line 7-13: The paths filter in the update-releasenotes workflow is too
broad and matches all files under docs/changelogs/** instead of only release
changelog files. Change the paths filter from matching 'docs/changelogs/**' to
specifically match 'docs/changelogs/v*.md' to ensure the workflow only triggers
when actual release changelog files (following the v*.md naming pattern
mentioned in the comment) are modified, preventing unnecessary workflow runs on
unrelated file edits in that directory.

LGTM

Business context: prunes four CI workflows that are broken, redundant, or noisier than needed — removes the never-working /retest workflow and narrows the triggers on CodeQL, Scorecard, and release-notes sync.

I verified that none of the affected workflows is a merge dependency:

• The only required status checks on main are pre-commit and E2E Tests; none of the four touched workflows contributes a required check, so none of these changes can block merges. Evidence: branch protection required_status_checks.contexts = ["pre-commit","E2E Tests"].
• No workflow_run trigger references any of these workflows, no reusable-workflow uses: points at the four files, and no README badge references them. Evidence: grep -rn 'workflow_run' .github/workflows/, grep -rn 'uses:.*workflows/' .github/workflows/, and the README grep all return nothing.
• retest.yaml is genuinely dead: it reran a job named Prepare environment, but that is now a step inside the E2E Tests job rather than a standalone job, so the job lookup always fails. The only /retest mention outside the deleted file is an immutable historical changelog entry. Evidence: pull-requests.yaml:260 - name: Prepare environment is a step under job E2E Tests (pull-requests.yaml:191); docs/changelogs/v0.40.0.md:149.

No blockers.

Non-blocking:

1. The description's run-history figures are imprecise. The workflow has 9 real (/retest) invocations, all failed, dating back to 2026-01-08 — not "two". The "0 successful runs" statement is also literally contradicted by the API, which reports 41 success runs; those are issue_comment events where the job-level if guard was false, which GitHub records as success with no steps executed. The conclusion (never completed a real retest, safe to remove) holds; only the stated numbers are off. Evidence: actions/workflows/retest.yaml/runs?status=failure total_count=9; ?status=success runs return steps: [].

2. Dropping the pull_request trigger from CodeQL shifts SAST from pre-merge to post-merge: a vulnerability introduced in a PR is now caught only after it lands on main (push) or at the weekly cron, not on the PR itself. Defensible given the zero-alert history and the autobuild network-fetch flake vector, but it is a detection-timing trade-off, not a pure no-op. Evidence: codeql.yml on: retains push: [main] plus the weekly schedule, with pull_request removed.

3. update-releasenotes.yaml loses its only fallback path. Previously any main push re-ran the sync, so a release whose changelog had already merged would still be picked up by a later unrelated push; now only docs/changelogs/** pushes trigger it, and there is no workflow_dispatch. If a release body ends up out of sync, recovery requires touching a changelog file. Consider adding workflow_dispatch: as a manual re-sync hatch. Evidence: update-releasenotes.yaml on: has only the path-gated push, no workflow_dispatch.

LGTM — four CI workflow changes are sound; none touches a required status check, and the nits below are non-blocking.

Business context: prunes four CI workflows that are broken, redundant, or noisier than needed — removes the never-working /retest workflow and narrows the triggers on CodeQL, Scorecard, and release-notes sync.

What I verified:

• retest.yaml is genuinely dead. It reran a job named Prepare environment, but that is now a step inside the E2E Tests job (pull-requests.yaml:269 under the job at :200), so the workflow's jobs.find(j => j.name === 'Prepare environment') lookup can never match. gh run rerun covers the need. No live docs reference /retest — only a historical changelog entry.
• No merge gate is affected. The required status checks on main are pre-commit and E2E Tests; none of the four touched workflows contributes either context, so dropping CodeQL's per-PR run / Scorecard's push trigger cannot block a merge.
• scorecard.yml: removing security-events: write is safe — once the upload-sarif step is gone, no remaining step under the analysis job needs that scope; publish_results: true keeps the public scorecard.dev viewer populated.

Non-blocking follow-ups:

1. "0 successful runs in its entire recorded history" (PR body + the ci: remove broken retest workflow commit message) is overstated. The API records 41 success runs for retest.yaml — these are issue_comment events where the job-level if guard was false, which GitHub records as success with no steps executed. The conclusion (never completed a real retest since the TIA refactor, safe to delete) holds; only the absolute claim is wrong. Since it lives in a permanent commit message, consider rewording to "no successful retest since the TIA refactor; every real /retest invocation since has failed with Could not find Prepare environment job."

2. scorecard.yml bakes "168 alerts" into a source comment. Hardcoded counts rot immediately — the live count already differs from this figure — and a future reader who runs the API query will distrust the comment. The qualitative argument (Scorecard floods code-scanning and buries CodeQL's findings) stands on its own; drop the specific number or there is now a magic constant to maintain.

3. The paths: docs/changelogs/** filter is slightly broader than the stated intent. docs/changelogs/ also holds template.md and patch-template.md, so an edit to either still fires the self-hosted job; docs/changelogs/v*.md matches only the release changelogs the comment describes. Practical impact is small (templates rarely change), so this is optional.

4. Dropping CodeQL's pull_request trigger shifts SAST from pre-merge to post-merge — a vulnerability introduced in a PR is now caught only after it lands on main or at the weekly cron, not on the PR itself. Defensible given the zero-alert history and the autobuild network-fetch flake vector, but it is a detection-timing trade-off rather than a pure no-op, worth naming in the rationale.

5. update-releasenotes.yaml loses its only fallback path. Previously any main push re-ran the sync; now only docs/changelogs/** pushes do, and there is no workflow_dispatch. If a release body ends up out of sync, recovery requires touching a changelog file. Consider adding workflow_dispatch: as a manual re-sync hatch.

Code Review

This pull request updates the SECURITY.md file to include a detailed section on automated security analysis, explaining the usage of CodeQL and OpenSSF Scorecard. The review feedback suggests formatting the long paragraphs in the list items using semantic line wraps to improve readability and make future git diffs cleaner, along with a minor grammatical correction.

LGTM — this addresses the pre-merge SAST follow-up cleanly.

CodeQL is back on pull_request (plus push: [main] and the weekly cron), so SAST runs before merge again rather than only post-merge. The Go analysis switched from autobuild to build-mode: manual with an explicit per-module build, and I verified the build step covers every first-party module — ., api/apps/v1alpha1, packages/apps/kubernetes/images/kubevirt-csi-driver, packages/system/dashboard/images/token-proxy, packages/system/kubeovn-webhook/images/kubeovn-webhook — which is exactly the set of go.mod files in the tree, so CodeQL gets a complete database with no silently-missed module, and without the make/autobuild upstream-fetch flake. set -euxo pipefail means a build failure fails the job, so the check is meaningful.

The other prunes are unchanged from before and remain sound (dead /retest removal, Scorecard SARIF-upload drop, releasenotes path filter), and the new SECURITY.md section documenting the CodeQL/Scorecard split is accurate.

Note (out of scope for this PR): making CodeQL actually block merges is a branch-protection change — the Analyze (go) check needs adding to the required status checks on main (currently pre-commit + E2E Tests), which is a repo-settings action separate from this PR. Worth doing only after this merges, so the check exists on the PR workflow before it's marked required.

Approving.