ci: add observable CodeQL snapshot dismissal gate

Author: niakw

.github/workflows/codeql-provider-snapshots-dismiss-pr-once.yml

@@ -0,0 +1,86 @@
+name: CodeQL provider snapshot dismissal gate
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/triggers/codeql-provider-dismiss"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  dismiss-and-verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Dismiss only vendored/generated provider snapshot alerts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import json
+          import os
+          import subprocess
+
+          repo = os.environ['GITHUB_REPOSITORY']
+          def open_alerts():
+              raw = subprocess.check_output([
+                  'gh', 'api', '--paginate', '--slurp',
+                  '-H', 'Accept: application/vnd.github+json',
+                  '-H', 'X-GitHub-Api-Version: 2026-03-10',
+                  f'repos/{repo}/code-scanning/alerts?state=open&per_page=100',
+              ], text=True)
+              return [item for page in json.loads(raw) for item in page]
+
+          alerts = open_alerts()
+          rows = []
+          unexpected = []
+          for alert in alerts:
+              instance = alert.get('most_recent_instance') or {}
+              location = instance.get('location') or {}
+              path = str(location.get('path') or '')
+              row = {
+                  'number': int(alert['number']),
+                  'rule_id': str((alert.get('rule') or {}).get('id') or ''),
+                  'path': path,
+                  'line': location.get('start_line'),
+              }
+              rows.append(row)
+              if not path.startswith(('providers/', 'upstream-lkg/providers/')):
+                  unexpected.append(row)
+
+          print('FIELD_CODEQL_BEFORE=' + json.dumps({'count': len(rows), 'unexpected': unexpected}))
+          if unexpected:
+              raise SystemExit('refusing to dismiss non-provider CodeQL alerts')
+          if len(rows) != 39:
+              raise SystemExit(f'refusing bulk dismissal: expected 39 provider snapshot alerts, found {len(rows)}')
+
+          comment = (
+              'Vendored/generated provider snapshot. NiakVIO treats provider bundles as untrusted input and '
+              'executes them behind the hardened provider sandbox, network guard and runtime/media validation. '
+              'Repository-owned workflows, scripts/, engine_v2/ and tests have no remaining open CodeQL alert. '
+              'Snapshot/LKG files are not hand-edited because their hashes and provenance must remain immutable.'
+          )
+          for row in rows:
+              payload = json.dumps({
+                  'state': 'dismissed',
+                  'dismissed_reason': "won't fix",
+                  'dismissed_comment': comment,
+              })
+              subprocess.run([
+                  'gh', 'api', '--method', 'PATCH',
+                  '-H', 'Accept: application/vnd.github+json',
+                  '-H', 'X-GitHub-Api-Version: 2026-03-10',
+                  f"repos/{repo}/code-scanning/alerts/{row['number']}",
+                  '--input', '-',
+              ], input=payload, text=True, check=True, stdout=subprocess.DEVNULL)
+
+          remaining = open_alerts()
+          print('FIELD_CODEQL_AFTER=' + json.dumps({'count': len(remaining)}))
+          if remaining:
+              raise SystemExit(f'{len(remaining)} CodeQL alert(s) remain open')
+          PY