From 8f1ee44141e26e0d9a4d6e6f09a488472c853f99 Mon Sep 17 00:00:00 2001
From: Thang Luu <76550342+thangldw@users.noreply.github.com>
Date: Sun, 23 Aug 2026 21:44:29 +0900
Subject: [PATCH 1/3] ci: disable cache in checkout-free Windows job

---
 .github/workflows/ci.yml       | 1 +
 tests/test_github_workflows.py | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dddb202..d0f537d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,6 +50,7 @@ jobs:
       - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           version: "0.12.5"
+          enable-cache: false
       - name: Run published credential-free demo without checkout
         shell: pwsh
         run: |
diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py
index 9e9aedf..57c36e8 100644
--- a/tests/test_github_workflows.py
+++ b/tests/test_github_workflows.py
@@ -31,6 +31,7 @@ def test_windows_no_clone_demo_uses_the_published_package() -> None:
 
     assert "runs-on: windows-latest" in windows_job
     assert "actions/checkout@" not in windows_job
+    assert "enable-cache: false" in windows_job
     assert 'uvx --from "ragops==2.0.1" ragops demo' in windows_job
     assert '$summary.candidate_decision -ne "BLOCK"' in windows_job
     assert "demo-output/release-report.html" in windows_job

From 7bc8b4ca44d3feb46c0c2e3f7ba85455ebd67134 Mon Sep 17 00:00:00 2001
From: Thang Luu <76550342+thangldw@users.noreply.github.com>
Date: Sun, 23 Aug 2026 21:45:48 +0900
Subject: [PATCH 2/3] ci: acknowledge empty no-checkout workdir

---
 .github/workflows/ci.yml       | 1 +
 tests/test_github_workflows.py | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d0f537d..9d004b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,6 +51,7 @@ jobs:
         with:
           version: "0.12.5"
           enable-cache: false
+          ignore-empty-workdir: true
       - name: Run published credential-free demo without checkout
         shell: pwsh
         run: |
diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py
index 57c36e8..7e1e1b5 100644
--- a/tests/test_github_workflows.py
+++ b/tests/test_github_workflows.py
@@ -32,6 +32,7 @@ def test_windows_no_clone_demo_uses_the_published_package() -> None:
     assert "runs-on: windows-latest" in windows_job
     assert "actions/checkout@" not in windows_job
     assert "enable-cache: false" in windows_job
+    assert "ignore-empty-workdir: true" in windows_job
     assert 'uvx --from "ragops==2.0.1" ragops demo' in windows_job
     assert '$summary.candidate_decision -ne "BLOCK"' in windows_job
     assert "demo-output/release-report.html" in windows_job

From cc66f0f25debcdf59652d98d49317abb18eb2eb7 Mon Sep 17 00:00:00 2001
From: Thang Luu <76550342+thangldw@users.noreply.github.com>
Date: Sun, 23 Aug 2026 21:47:39 +0900
Subject: [PATCH 3/3] ci: update CodeQL action to v4

---
 .github/workflows/codeql.yml   | 4 ++--
 tests/test_github_workflows.py | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c29ac34..8fa0725 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,10 +20,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           languages: python
           build-mode: none
-      - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           category: "/language:python"
diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py
index 7e1e1b5..b1c4739 100644
--- a/tests/test_github_workflows.py
+++ b/tests/test_github_workflows.py
@@ -49,11 +49,11 @@ def test_codeql_is_least_privilege_and_immutably_pinned() -> None:
     assert "build-mode: none" in workflow
     assert workflow.count(
         "github/codeql-action/"
-        "init@42947a340483f03ba47bb1a039b2c519aab3df85"
+        "init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"
     ) == 1
     assert workflow.count(
         "github/codeql-action/"
-        "analyze@42947a340483f03ba47bb1a039b2c519aab3df85"
+        "analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"
     ) == 1