From f95ad5a4262436bb5d316cd7e456f332f09840a5 Mon Sep 17 00:00:00 2001
From: thedancingdeveloper
 <306930456+thedancingdeveloper@users.noreply.github.com>
Date: Tue, 25 Aug 2026 09:03:10 +0000
Subject: [PATCH 1/3] ci: consume canonical GHCR retention policy

---
 .github/workflows/ghcr-retention.yml | 25 +++++++++++++++++++++++++
 docs/GHCR-RETENTION.md               |  9 +++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 .github/workflows/ghcr-retention.yml
 create mode 100644 docs/GHCR-RETENTION.md

diff --git a/.github/workflows/ghcr-retention.yml b/.github/workflows/ghcr-retention.yml
new file mode 100644
index 0000000..43cfa0d
--- /dev/null
+++ b/.github/workflows/ghcr-retention.yml
@@ -0,0 +1,25 @@
+name: GHCR retention policy
+
+on:
+  schedule:
+    - cron: "17 3 * * 0"
+  workflow_dispatch:
+    inputs:
+      apply:
+        description: Apply the reviewed dry-run plan
+        type: boolean
+        default: false
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  retention:
+    uses: TheDancingDeveloper-org/github-policy/.github/workflows/ghcr-retention-reusable.yml@main
+    with:
+      packages: "rustnzbd"
+      apply: ${{ inputs.apply || false }}
+    secrets:
+      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
diff --git a/docs/GHCR-RETENTION.md b/docs/GHCR-RETENTION.md
new file mode 100644
index 0000000..bc72a6f
--- /dev/null
+++ b/docs/GHCR-RETENTION.md
@@ -0,0 +1,9 @@
+# GHCR retention
+
+Container retention for this repository is governed by the organization-wide
+policy in [github-policy](https://github.com/TheDancingDeveloper-org/github-policy/blob/main/docs/GHCR-RETENTION.md).
+The local workflow only declares this repository's package names; it does not
+define separate retention numbers or cleanup rules.
+
+The scheduled run is a dry run and uploads before/after counts and a deletion
+plan. Applying a plan requires an explicit workflow dispatch after review.

From ca2689c387fbe9b62ee27242b38af85603054f30 Mon Sep 17 00:00:00 2001
From: thedancingdeveloper
 <306930456+thedancingdeveloper@users.noreply.github.com>
Date: Sat, 29 Aug 2026 22:11:57 +0000
Subject: [PATCH 2/3] ci: add CodeQL code scanning for Rust and the Angular
 frontend

Adds static analysis (code scanning) covering the Rust workspace (build-mode
autobuild) and the TypeScript/Angular frontend (build-mode none). Findings
surface under Security > Code scanning and as PR annotations.

Runs on the same self-hosted [self-hosted, node-b, linux, x64, rust] fleet as
the rest of CI (passes the runner-policy gate; verified with
scripts/runner_policy.py). Triggers on push to main, PRs, a weekly schedule,
and manual dispatch. Bot (Dependabot) PRs are skipped, matching ci.yml.

Companion to enabling secret scanning + push protection on the repository.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NcRDAbyqhY88qnQBaMtue8
---
 .github/workflows/codeql.yml | 66 ++++++++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..a8238fb
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,66 @@
+name: CodeQL
+
+# Static analysis (code scanning) for the Rust workspace and the Angular
+# frontend. Findings surface under the repository's Security > Code scanning
+# tab and as PR annotations.
+#
+# Runners: matches the rest of CI on the self-hosted fleet so the runner-policy
+# gate passes. The `rust` runner already carries cargo (for the Rust build
+# tracer) and Node, so a single label set covers both languages.
+
+on:
+  push:
+    branches: [main]
+    paths-ignore: ["*.md", "docs/**", "AGENTS.md", "CONTRIBUTING.md", "SECURITY.md"]
+  pull_request:
+    paths-ignore: ["*.md", "docs/**", "AGENTS.md", "CONTRIBUTING.md", "SECURITY.md"]
+  schedule:
+    # Weekly, so advisories that appear after a quiet period are still caught.
+    - cron: "27 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Dependabot PRs change dependency metadata only; skip to avoid spending a
+    # self-hosted runner on each. Skipped jobs report success, so a required
+    # check would not stay pending.
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.type != 'Bot'
+    runs-on: [self-hosted, node-b, linux, x64, rust]
+    permissions:
+      # Uploading CodeQL results requires write on security events.
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: rust
+            build-mode: autobuild
+          - language: javascript-typescript
+            build-mode: none
+    env:
+      # Match the memory-conscious build settings the rest of CI uses on the
+      # isolated runners.
+      CARGO_BUILD_JOBS: 1
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

From 023c47c8c605c49ca2224e038579449efb75d524 Mon Sep 17 00:00:00 2001
From: thedancingdeveloper
 <306930456+thedancingdeveloper@users.noreply.github.com>
Date: Sun, 30 Aug 2026 00:19:51 +0000
Subject: [PATCH 3/3] ci: use build-mode none for Rust CodeQL (autobuild
 unsupported)

The Rust extractor in the CodeQL bundle only supports buildless extraction;
`database init --build-mode=autobuild` fails with "Rust does not support the
autobuild build mode." Switch the Rust matrix entry to build-mode: none (the
js/ts entry already was), which also removes any build/tracing memory concern.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NcRDAbyqhY88qnQBaMtue8
---
 .github/workflows/codeql.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a8238fb..5b4bc42 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,8 +5,8 @@ name: CodeQL
 # tab and as PR annotations.
 #
 # Runners: matches the rest of CI on the self-hosted fleet so the runner-policy
-# gate passes. The `rust` runner already carries cargo (for the Rust build
-# tracer) and Node, so a single label set covers both languages.
+# gate passes. Both languages use buildless extraction (build-mode: none), so
+# no compiler/toolchain step is needed; a single label set covers both.
 
 on:
   push:
@@ -43,14 +43,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # Rust CodeQL only supports buildless extraction (build-mode: none);
+          # it does not support autobuild.
           - language: rust
-            build-mode: autobuild
+            build-mode: none
           - language: javascript-typescript
             build-mode: none
-    env:
-      # Match the memory-conscious build settings the rest of CI uses on the
-      # isolated runners.
-      CARGO_BUILD_JOBS: 1
     steps:
       - uses: actions/checkout@v7