security: resolve CodeQL core findings and clean comments

* ci: export CodeQL alerts for triage

* ci: allow PR CodeQL triage export

* ci: include comment hygiene sweep in CodeQL triage

* ci: build isolated CodeQL core fixes

* ci: isolate CodeQL fix transformation

* ci: run isolated CodeQL fix script

* security: resolve CodeQL core findings and clean comments

* chore: remove temporary CodeQL triage workflow

* chore: remove temporary CodeQL fix builder

* chore: remove temporary CodeQL fix script

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: niakw

.github/workflows/native-corpus-device-lab.yml

@@ -1,7 +1,6 @@
 name: Native corpus device lab
 
 on:
-  workflow_dispatch:
   workflow_run:
     workflows:
       - Niakvio provider pipeline

.github/workflows/native-corpus-device-targeted.yml

@@ -13,11 +13,6 @@ on:
           - mobile
           - desktop
           - all
-      target_ref:
-        description: Niakvio ref/SHA to validate
-        required: false
-        default: main
-        type: string
   push:
     branches: [main]
     paths:
@@ -40,33 +35,30 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 8
     outputs:
-      target_sha: ${{ steps.resolve.outputs.target_sha }}
       targets: ${{ steps.resolve.outputs.targets }}
       desktop_sha: ${{ steps.resolve.outputs.desktop_sha }}
       mobile_sha: ${{ steps.resolve.outputs.mobile_sha }}
       tv_sha: ${{ steps.resolve.outputs.tv_sha }}
     steps:
-      - name: Checkout requested Niakvio generation
+      - name: Checkout selected Niakvio generation
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.target_ref || 'main' }}
           fetch-depth: 1
+          persist-credentials: false
 
-      - name: Resolve exact generation, selected devices and accepted clients
+      - name: Resolve selected devices and accepted clients
         id: resolve
         shell: bash
         env:
           EVENT_NAME: ${{ github.event_name }}
           INPUT_DEVICE: ${{ inputs.device }}
         run: |
           set -euo pipefail
-          TARGET_SHA="$(git rev-parse HEAD)"
           if [ "$EVENT_NAME" = "push" ]; then
             DEVICE="tv"
           else
             DEVICE="${INPUT_DEVICE:-tv}"
           fi
-          echo "target_sha=$TARGET_SHA" >> "$GITHUB_OUTPUT"
           DEVICE="$DEVICE" python3 - <<'PY' >> "$GITHUB_OUTPUT"
           import json
           import os
@@ -119,8 +111,9 @@ jobs:
       - name: Checkout exact Niakvio generation
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
-          ref: ${{ needs.resolve.outputs.target_sha }}
+          ref: ${{ github.sha }}
           path: niakvio
+          persist-credentials: false
 
       - name: Set up JDK
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165

scripts/promote_candidates.py

@@ -97,9 +97,8 @@ def manifest_payload_without_version(manifest: dict[str, Any]) -> dict[str, Any]
 def next_manifest_version(current_version: str, base_version: str, changed: bool) -> str:
     """Keep the manifest in the configured version series and bump on payload changes.
 
-    ``base_version`` is a version floor. This prevents an unchanged run from
-    preserving an obsolete series (for example 5.13.x after the repository has
-    moved to 5.14.x).
+    ``base_version`` is a version floor so unchanged runs cannot preserve an
+    obsolete version series.
     """
     def parse(value: str) -> tuple[int, int, int] | None:
         match = re.fullmatch(r"(\d+)\.(\d+)\.(\d+)", str(value or ""))
@@ -2186,8 +2185,8 @@ def rank(variant: dict[str, Any]) -> tuple[int, int, int, int, int, int, int]:
             and not metadata_is_excluded(old_entry, sources)
         ):
             retained = dict(old_entry)
-            # A transient source download failure must not silently disable a
-            # previously published local provider.
+            # A transient source download failure must not disable a published
+            # local provider.
             retained["enabled"] = bool(old_entry.get("enabled", False))
             entries[cid] = retained
             old_provenance = previous_provenance.get("providers", {}).get(cid, {})

scripts/provider_dns_preflight.mjs

@@ -263,7 +263,6 @@ export function createGlobalpingDependencies(preflightConfig, injected = {}) {
             locations: [{ magic: dnsResult.measurement_id }],
             limit: 1,
             // Globalping HTTP options are top-level within measurementOptions.
-            // The previous nested request object was rejected with HTTP 400.
             measurementOptions: { method: 'GET', ipVersion: 4 },
           }, remoteConfig);
           return parseGlobalpingHttp(measurement, host);

scripts/publish_cross_platform_runtime_policy.py

@@ -3,8 +3,8 @@
 
 Only conclusive runtime failures from the fresh platform matrix can add a
 platform block. Zero streams is inconclusive and never creates a block. The
-legacy 5.20.27 Android blocks that were based only on missing proof are removed
-when fresh evidence remains inconclusive. Existing blocks not managed by this
+Android blocks based only on missing proof are removed when fresh evidence
+remains inconclusive. Existing blocks not managed by this
 policy are preserved.
 """
 from __future__ import annotations
@@ -149,8 +149,8 @@ def main() -> int:
             else:
                 # Inconclusive evidence cannot create or remove a previously
                 # conclusive cross-platform block. The one exception is the
-                # legacy Android no-proof policy, whose basis was deliberately
-                # weaker and is retired by this release.
+                # Android no-proof blocks are weaker than conclusive runtime
+                # evidence and are retired once fresh evidence is inconclusive.
                 legacy_weak = token == "android" and provider_id in {
                     str(value).casefold() for value in legacy.get("android_disabled_no_direct_movie_proof") or []
                 } and token not in {

tests/deep_repair_rollback_test.py

@@ -5,10 +5,9 @@
 
 ROOT = Path(__file__).resolve().parents[1]
 MARKER = '[Nuvio Runtime Repair] Using fixture title metadata'
-# These providers previously received a bad metadata-context repair. The durable
-# invariant is that the marker never returns and that manifest/provenance/hash
-# describe the exact current published bytes. Hard-coding an old SHA made this
-# regression test reject legitimate repository-wide playback hardening.
+# These published artifacts must never contain the rejected metadata-context
+# marker. Manifest, provenance and hashes must describe the exact current bytes;
+# fixed historical SHAs would incorrectly reject legitimate artifact rotation.
 ROLLBACK_PROVIDERS = {'anime-ultime', 'dulourd', 'waveanime'}
 ALLOWED_SOURCES = {'gowaru', 'published-baseline', 'nuvio'}
 OLD = {

tests/native_catalogue_recovery_budget_test.py

@@ -42,8 +42,8 @@
 assert patched.count('var TMDB_KEY="8265bd1679663a7ea12ac168da84d2e8";') == 3
 assert module.apply(patched) == patched
 
-# A provider produced by the previous V1 budget revision must upgrade in place,
-# rather than keeping the overly narrow first-two-search policy forever.
+# V1-produced providers must upgrade in place rather than retaining the
+# narrower first-two-search policy.
 legacy = r'''/* NUVIO_GLOBAL_CATALOGUE_ALIAS_RECOVERY_V2:abc */
 ;(function(g,c){"use strict";
 var TMDB_KEY="8265bd1679663a7ea12ac168da84d2e8";function nativeRecoveryHost(){try{return typeof g.__native_fetch==="function"}catch(_){return false}}

tests/published_overrides_test.py

@@ -38,9 +38,7 @@
 # pending manifest while still being authoritative through the published
 # manifest, LKG or provenance. Validation must never delete such a bundle just
 # because it still contains an old domain; prune owns deletion after all
-# references converge. Regression: Coflix was deleted after strict validation,
-# then the manifest transaction failed because provenance/LKG still referenced
-# the deleted content-addressed bundle.
+# references converge.
 with tempfile.TemporaryDirectory() as tmp:
     root = Path(tmp)
     (root/'providers').mkdir()
@@ -80,9 +78,8 @@
     assert protected.exists(), 'validator deleted a bundle still protected by the publication transaction'
     assert pending.exists()
 
-# A provider id must not match a longer sibling id while removing stale files.
-# Regression: validating 4khdhub previously deleted 4khdhubnew because the
-# cleanup used the broad glob ``4khdhub*.js``.
+# Stale-file removal must use exact provider-id boundaries so a provider id
+# cannot match a longer sibling id.
 with tempfile.TemporaryDirectory() as tmp:
     root = Path(tmp)
     (root/'providers').mkdir()

tests/strict_native_identity_guard_test.py

@@ -16,8 +16,8 @@
 patched = module.apply(base, options)
 assert "nativeIdentityReject" in patched
 assert "implementationRevision" in patched
-# Same config must be idempotent, while an implementation-revision upgrade must
-# have stripped the previous V2 block instead of stacking it.
+# Reapplying the same config is idempotent; implementation upgrades replace
+# the existing V2 block instead of stacking another copy.
 assert module.apply(patched, options) == patched
 assert patched.count("NUVIO_GLOBAL_CATALOGUE_ALIAS_RECOVERY_V2:") == 1
 runner = r'''