ci: run code and security checks on RC pushes

[VishnuM049]

Purpose

The integration branch RC receives code without a push-triggered CI run. The aggregate draft PR #394 currently has no GitHub Actions checks for its latest head. Run the existing CI, CodeQL, and Secrets Scan workflows on RC pushes as well as their existing PR and release triggers.

Fixes

The missing RC push trigger. This does not change branch protection or enable production remote access.

Approach

• Add RC to the push branch lists in the three workflows.
• Add a regression test that fails if any of these workflows drops the RC push trigger.
• Keep Dependency Review PR/merge-queue only because its action requires comparison refs from those events.

GitHub Actions must run on an actual RC push before this can be called operationally verified; this PR alone does not retroactively check the current #394 head.

How was this tested?

• pnpm install --frozen-lockfile --offline --ignore-scripts: passed.
• node --test scripts/rc-workflows.test.ts: 3 passed, 0 skipped.
• pnpm --filter @axl/protocol build: passed.
• pnpm exec biome check scripts/rc-workflows.test.ts, pnpm lint, pnpm format:check: passed.
• pnpm check:boundaries, pnpm check:generated, reuse lint, git diff --check: passed.
• Initial pnpm exec biome check found formatting and regex-style issues; corrected and rerun successfully. Initial pnpm check:generated failed because the protocol package had not yet been built in this new worktree; building it and rerunning passed.
• actionlint was unavailable locally. GitHub Actions execution and RC branch protection could not be verified locally. No full application E2E was run for this workflow-only change.

Checklist

• Responsible contributor reviewed the complete diff and approves publication/merge.
• Small regression test added.
• Relevant local checks passed; unavailable verification is listed above.
• New file carries SPDX metadata.
• Commit has a matching DCO Signed-off-by trailer.
• No interface change; screenshots not applicable.

AI assistance

• Pi coding agent materially assisted this change. The model identifier was not exposed to the agent session; the responsible contributor should record it before merge if available.
• Responsible contributor manually reviewed and understood the final diff.

Summary by CodeRabbit

• Maintenance
  • CI, security analysis, and secrets scanning now also run on pushes to the RC branch.
• Tests
  • Added coverage to verify these workflows include RC in their push triggers.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 91f80459-c907-4686-b6e3-804a5c4b6fe7

---

📥 Commits

Reviewing files that changed from the base of the PR and between 339ae6c and 6b4ebc2.

---

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/gitleaks.yml
• scripts/rc-workflows.test.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The CI, CodeQL, and Secrets Scan workflows now run on pushes to the RC branch. A test checks that all three workflows include RC in their push branch filters.

Changes

RC workflow triggers

Layer / File(s)	Summary
Push branch filters and validation .github/workflows/ci.yml, .github/workflows/codeql.yml, .github/workflows/gitleaks.yml, scripts/rc-workflows.test.ts	The three workflows add RC to their push branch filters. A test checks that each workflow declares push branches and includes RC.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

---

Merge Risk: ⚪ Minimal · up to 6b4eb

RC pushes now trigger CI, CodeQL, and Secrets Scan, with a CI-run test guarding those push filters. No concrete merge-blocking risk remains; the change is ready subject to normal checks.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the primary change: running code and security checks on RC pushes.
Description check		The description covers the purpose, fix, approach, testing, checklist, and AI assistance. It also clearly identifies unavailable local checks and the need for an actual RC push for operational verific…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[VishnuM049]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.