From 81ee77fce4aa64493d0ec1bdf0be4f30a8d92d4e Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Tue, 3 Nov 2026 18:19:01 +0800
Subject: [PATCH] fix(ci): batch main CodeQL scans hourly

---
 .ci-policy.md                |  1 +
 .github/workflows/codeql.yml | 10 ++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)
 create mode 100644 .ci-policy.md

diff --git a/.ci-policy.md b/.ci-policy.md
new file mode 100644
index 0000000000..b4fa4811ff
--- /dev/null
+++ b/.ci-policy.md
@@ -0,0 +1 @@
+CodeQL scans main hourly to batch frequent docs-sync changes; PR/manual scans remain enabled and deployment/release gates are unchanged.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6bb1af182d..f3ed65fdb4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,13 +2,15 @@ name: CodeQL
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
   schedule:
-    - cron: "41 4 * * 1"
+    - cron: "11 * * * *"
   workflow_dispatch:
 
+# Keep scheduled scans running; only superseded PR scans should be cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || (github.event_name == 'schedule' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   actions: read
   contents: read