ci: support full validation on workflow_dispatch (no PR context)

.github/scripts/pr-compile.sh

@@ -1,14 +1,30 @@
 #!/bin/bash
 set -euo pipefail
 
-PR_NUMBER=${1}
+PR_NUMBER=${1:-}
 LANGUAGE=${2}
 # to stop recompiling all queries if multiple files are modified
 LIBRARY_SCANNED=false
 
 echo "[+] Compiling all queries in $LANGUAGE"
 codeql query compile --threads=0 --check-only "./$LANGUAGE/"
 
+if [[ -z "$PR_NUMBER" ]]; then
+    # No PR context (e.g. workflow_dispatch run directly on a branch) - there is no PR
+    # file list to walk. The plain compile above already covers every query in the
+    # language directory, matching what publish.yml itself requires to ship a pack
+    # (`codeql pack install`/`publish` - neither treats warnings as fatal). We deliberately
+    # do NOT re-run with --warnings=error here: today's tree has pre-existing deprecated-API
+    # warnings in a handful of files that were never caught because no PR-mode diff has ever
+    # touched all of them at once. Failing full-mode runs on that backlog would block CI-infra
+    # validation on unrelated debt. See the tracking issue for the plan to clean up the
+    # backlog and then make PR-mode itself trigger a full strict compile whenever a PR
+    # touches .codeqlversion or a codeql-pack.lock.yml (a dependency/CLI bump can change
+    # behavior across every query, not just the files literally edited).
+    echo "[+] No PR number provided - full compile above already covered $LANGUAGE. Done."
+    exit 0
+fi
+
 for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     if [[ ! -f "$file" ]]; then
         continue
@@ -31,4 +47,4 @@ for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     fi
 done
 
-echo "[+] Complete"
+echo "[+] Complete"

.github/scripts/pr-configs.sh

@@ -1,31 +1,48 @@
 #!/bin/bash
 set -euo pipefail
 
-PR_NUMBER=${1}
+PR_NUMBER=${1:-}
 
 codeql_code="/tmp/codeql-test-code"
 codeql_db="/tmp/codeql-test-database"
 
-for file in $(gh pr view $PR_NUMBER --json files --jq '.files.[].path'); do
+compile_config() {
+    local file=$1
+    echo "[+] Compiling Config :: $file"
+
+    if [[ -d "$codeql_db" ]]; then
+        rm -rf "$codeql_db"
+    fi
+
+    mkdir -p "$codeql_code"
+    echo "print('Hello, World!')" > "$codeql_code/main.py"
+
+    codeql database create \
+        --source-root=$codeql_code \
+        --language=python \
+        --codescanning-config=$file \
+        "$codeql_db"
+}
+
+if [[ -z "$PR_NUMBER" ]]; then
+    # No PR context (e.g. workflow_dispatch run directly on a branch) - there is no PR
+    # file list to walk, so validate every config directly from the filesystem instead.
+    echo "[+] No PR number provided - validating all configs/*.yml"
+    for file in configs/*.yml; do
+        [[ -f "$file" ]] || continue
+        compile_config "$file"
+    done
+    echo "[+] Complete"
+    exit 0
+fi
+
+for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     if [[ ! -f "$file" ]]; then
         continue
     fi
 
     # config file
     if [[ "$file" == configs/*.yml ]]; then
-        echo "[+] Compiling Config :: $file"
-
-        if [[ -d "$codeql_db" ]]; then
-            rm -rf "$codeql_db"
-        fi
-
-        mkdir -p "$codeql_code"
-        echo "print('Hello, World!')" > "$codeql_code/main.py"
-
-        codeql database create \
-            --source-root=$codeql_code \
-            --language=python \
-            --codescanning-config=$file \
-            "$codeql_db"
+        compile_config "$file"
     fi
-done
+done

.github/scripts/pr-suites-packs.sh

@@ -1,10 +1,36 @@
 #!/bin/bash
 set -euo pipefail
 
-PR_NUMBER=${1}
+PR_NUMBER=${1:-}
 LANGUAGE=${2}
 PACK_COMPILED=false
 
+if [[ -z "$PR_NUMBER" ]]; then
+    # No PR context (e.g. workflow_dispatch run directly on a branch) - there is no PR
+    # file list to walk, so resolve every suite and (re)build the language's packs
+    # directly. There is no PR to comment on, so the version-diff-comment logic below
+    # is intentionally skipped in this mode.
+    echo "[+] No PR number provided - running full suite/pack validation for $LANGUAGE"
+
+    if [[ -d "$LANGUAGE/suites" ]]; then
+        while IFS= read -r -d '' suite; do
+            echo "[+] Compiling Suite: $suite"
+            codeql resolve queries "$suite"
+        done < <(find "$LANGUAGE/suites" -name '*.qls' -print0)
+    fi
+
+    for pack_dir in "$LANGUAGE/src" "$LANGUAGE/lib" "$LANGUAGE/ext" "$LANGUAGE/ext-library-sources"; do
+        if [[ -f "$pack_dir/qlpack.yml" ]]; then
+            echo "[+] Compiling Pack: $pack_dir"
+            codeql pack install "$pack_dir"
+            codeql pack create "$pack_dir"
+        fi
+    done
+
+    echo "[+] Complete"
+    exit 0
+fi
+
 for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     if [[ ! -f "$file" ]]; then
         continue
@@ -72,4 +98,4 @@ for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     fi
 done
 
-echo "[+] Complete"
+echo "[+] Complete"

.github/workflows/ci.yml

@@ -37,12 +37,12 @@ jobs:
               - '.github/**'
 
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         id: install-codeql
         uses: ./.github/actions/install-codeql
 
       - name: Install Packs
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
           CODEQL_CLI_VERSION: ${{ steps.install-codeql.outputs.codeql-cli-version }}
@@ -53,14 +53,14 @@ jobs:
           codeql pack install "${{ matrix.language }}/test"
 
       - name: Compile Queries
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          ./.github/scripts/pr-compile.sh ${{ github.event.number }} ${{ matrix.language }}
+          ./.github/scripts/pr-compile.sh "${{ github.event.number }}" "${{ matrix.language }}"
 
       - name: Test Queries
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           RUNNER_TEMP: ${{ runner.temp }}
         shell: python
@@ -110,7 +110,7 @@ jobs:
               file.close()
 
       - name: Upload test results
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.language }}-test-results
@@ -119,11 +119,11 @@ jobs:
           if-no-files-found: error
 
       - name: Compile / Check Suites & Packs
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          ./.github/scripts/pr-suites-packs.sh ${{ github.event.number }} ${{ matrix.language }}
+          ./.github/scripts/pr-suites-packs.sh "${{ github.event.number }}" "${{ matrix.language }}"
 
   validate-test-results:
     name: Validate test results
@@ -180,11 +180,11 @@ jobs:
               - '${{ matrix.language }}/ext/**'
 
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: ./.github/actions/install-codeql
 
       - name: Install Packs
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
@@ -213,11 +213,11 @@ jobs:
               - '${{ matrix.language }}/ext-library-sources/**'
 
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: ./.github/actions/install-codeql
 
       - name: Install CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
@@ -242,12 +242,12 @@ jobs:
               - 'configs/**'
 
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: ./.github/actions/install-codeql
 
       - name: "Check Configurations"
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          ./.github/scripts/pr-configs.sh "${{ github.event.number }}"
+          ./.github/scripts/pr-configs.sh "${{ github.event.number }}"