fix(ci): unblock appinspect.yml + guard codeql.yml for private repos

Two CI fixes plus a §7.5 honest-correction in APPINSPECT_FINDINGS.md.

1) appinspect.yml — remove `cache: pip`
   The job has been failing since 2026-05-17 17:12 with:
     "No file in /home/runner/work/wl_manager/wl_manager matched to
      [**/requirements.txt or **/pyproject.toml]"
   actions/setup-python@v5 with `cache: pip` requires one of those
   manifests to compute the cache key. This repo has only
   requirements-dev.txt — close-but-not-matching the cache glob.
   The single `pip install` in this workflow uses --no-cache-dir
   so the cache was a no-op anyway. Drop it.

2) codeql.yml — guard `if: github.event.repository.private == false`
   The first CodeQL run (after Batch 1 landed the workflow) failed
   with "Code scanning is not enabled for this repository". CodeQL
   requires "Code scanning" enabled at the repo level; for private
   repos that's gated behind GitHub Advanced Security (paid). For
   public repos it's free and auto-enables. The repo flips public
   in PUBLIC_RELEASE_PLAN.md Phase 3.4 — until then, skip the job
   cleanly. After the flip the `if:` evaluates true and CodeQL
   starts without any further config change.

3) docs/APPINSPECT_FINDINGS.md §7.5 + §8 revision-log correction
   The Phase 1.8 closure claimed "appinspect.yml CLI workflow green
   ✅ Phase 1.2" but in fact the workflow was failing the entire
   time. Content was always correct (Phase 1.3 baseline 0 error / 0
   failure), only CI wiring broken. The error is a process bug:
   Phase 1 acceptance was declared without spot-checking every
   workflow's actual run status. Logged in qa-findings.jsonl as
   `false-completion-claim-without-ci-verification` for the
   bi-weekly review.

Both workflow fixes will trigger fresh runs on this push. Expected
outcome: appinspect.yml goes green (content was always clean);
codeql.yml shows "Job skipped" (the guard is working as designed).

Author: RelativisticJet

.github/workflows/appinspect.yml

@@ -52,11 +52,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # `cache: pip` was removed 2026-05-18 — actions/setup-python@v5
+      # requires `requirements.txt` or `pyproject.toml` to compute the
+      # cache key, and this repo has neither (only requirements-dev.txt,
+      # not a name setup-python globs for). The single `pip install` in
+      # this job uses `--no-cache-dir` anyway so caching was a no-op.
+      # Specifying `cache-dependency-path: requirements-dev.txt` would
+      # restore the cache, but with a single one-line install of a pinned
+      # package the cache hit is worthless. Keep simple.
       - name: Set up Python 3.11
         uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-          cache: pip
 
       # libmagic1 is required by splunk-appinspect's `python-magic`
       # transitive dep. Without it the install succeeds but every

.github/workflows/codeql.yml

@@ -45,6 +45,14 @@ concurrency:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
+    # CodeQL requires "Code scanning" enabled at the repo level. For
+    # PRIVATE repos that gate is GitHub Advanced Security (a paid
+    # feature this project does not have); for PUBLIC repos it is free
+    # and enables automatically. This `if:` guard skips the job
+    # cleanly until the repo flips public in PUBLIC_RELEASE_PLAN.md
+    # Phase 3.4. After that the guard evaluates true and the job runs
+    # without any further config change.
+    if: github.event.repository.private == false
     runs-on: ubuntu-latest
     timeout-minutes: 30
 

docs/APPINSPECT_FINDINGS.md

@@ -491,7 +491,7 @@ manual triage outstanding.
 
 | Criterion | Status |
 |-----------|--------|
-| `appinspect.yml` CLI workflow green | ✅ Phase 1.2 |
+| `appinspect.yml` CLI workflow green | ✅ Phase 1.2 — initial green flagged in error during Phase 1.7 closure (the workflow had been RED with an `actions/setup-python@v5` `cache: pip` config bug from 17:12 onward; the bug was a missing `requirements.txt`/`pyproject.toml` for the cache key, fixed 2026-05-18 in commit `<TBD>`. The local CLI's content findings — 0 error / 0 failure on both profiles in `.planning/appinspect/appinspect-*-phase1.json` (Phase 1.3 baseline) — were always correct; only the GHA wiring was broken.) |
 | `appinspect-api.yml` API workflow green | ✅ Phase 1.7 (run `26002056326`) |
 | 0 error-severity findings — `cloud` | ✅ (§5.1: 0 error / 1 failure suppressed via expect.yaml / 0 future_failure) |
 | 0 error-severity findings — `splunk-platform-standalone` | ✅ (§1) |
@@ -548,3 +548,20 @@ checkpoint at week 4) is **not applicable**. Next milestone per
   Note: the revision log was renumbered from §7 to §8 to accommodate
   the new Phase 1.8 closure section without breaking the sequential
   numbering (§1–§8). Internal cross-references updated.
+- 2026-05-18 — **correction to §7.5 row 1**. The Phase 1.8 closure
+  claimed `appinspect.yml` CLI workflow was green; in fact the GHA
+  job had been failing since 2026-05-17 17:12 with an
+  `actions/setup-python@v5` `cache: pip` configuration bug — the
+  cache key requires `requirements.txt` or `pyproject.toml` and this
+  repo has only `requirements-dev.txt`. The bug was not in
+  AppInspect content (Phase 1.3 baseline `.planning/appinspect/*-phase1.json`
+  was always 0 error / 0 failure) but in CI wiring. Fix: removed
+  `cache: pip` from the setup-python step (the only `pip install` in
+  this workflow uses `--no-cache-dir` so caching was a no-op anyway).
+  This row's status fixed in the same commit. **Lesson logged in
+  `~/.claude/state/qa-findings.jsonl` as
+  `false-completion-claim-without-ci-verification`** — Phase 1
+  acceptance was declared complete without spot-checking every
+  workflow's actual run status; the QA process must include a `gh
+  run list` cross-check on every claimed-green workflow at
+  phase-closure boundaries.