[Feat] Add CodeQL triage automation settings and UI

apps/api/src/handlers/tasks/automation-work-items/auto-act.ts

@@ -55,6 +55,12 @@ const AUTO_ACT_AUTOMATION_CONFIG: Record<
     executionTaskBootstrap: '$update-dependencies',
     enforceUniqueTargetEnvironments: true,
   },
+  codeql_triage: {
+    label: 'CodeQL triage',
+    maxActItems: 3,
+    executionTaskBootstrap: '$implement-changes',
+    enforceUniqueTargetEnvironments: true,
+  },
   security_auditor: {
     label: 'Security Auditor',
     maxActItems: 5,

apps/api/src/handlers/tasks/automation-work-items/launch.ts

@@ -63,6 +63,7 @@ function buildLateBoundChatReplyInstructions(
     'When the linked outcome is a draft PR, keep that PR mention in the main sentence or same paragraph instead of adding a second paragraph just to point at the PR. Link the draft PR number if the URL is available; otherwise keep the PR identifier plain text. Prefer wording like "I reviewed [alert #275](...) and opened [draft PR #4783](...)" or "I reviewed the Sentry issue SENTRY-123 and opened the resulting draft PR ..." over "That shipped in draft PR #4783."',
     'For blocker, no-op, deferred, or input-needed outcomes, keep the same single-message shape but report only the outcome-relevant details and do not invent remediation or verification sections.',
     'For example, a Dependabot closeout should read like: "I reviewed [alert #275](...) and opened [draft PR #4783](...) to address a high and two medium `undici` vulnerabilities in the API dependency bundle."',
+    'A CodeQL closeout should read like: "I reviewed [CodeQL alert #42](...) and opened [draft PR #4783](...) to fix an XSS pattern in the public comments renderer."',
     `A code-quality closeout should read like: "I reviewed the latest merged PRs and noticed the main ${surface} route had taken on auth, validation, logging, and several posting flows at once, which makes changes there risky. I pulled the posting logic into its own module so the route stays focused (#4707)."`,
     'A security closeout should read like: "I reviewed the latest merged PRs and caught a background job running with full model credentials and network access over untrusted code, guarded only by prompt text. Unattended runs now skip that path until it is properly isolated, and its output is treated as untrusted (#4711); attended runs are unaffected."',
     `Notice that these example closeouts stop as soon as the outcome and its impact are stated. Do not append a verification or validation sentence such as "I re-ran the targeted tests and typecheck and cleared the push-time gates before the PR was opened"; that reassurance lives in the linked PR, not the ${surface} closeout.`,

apps/api/src/handlers/tasks/automation-work-items/source.ts

@@ -4,6 +4,7 @@ export type AutomationKey = Extract<
   TaskSuggestionSource,
   | 'sentry_triage'
   | 'dependabot_triage'
+  | 'codeql_triage'
   | 'security_auditor'
   | 'code_quality_auditor'
   | 'ci_failure_triage'
@@ -15,6 +16,7 @@ export function isAutomationWorkItemSource(
   return (
     source === 'sentry_triage' ||
     source === 'dependabot_triage' ||
+    source === 'codeql_triage' ||
     source === 'security_auditor' ||
     source === 'code_quality_auditor' ||
     source === 'ci_failure_triage'

apps/api/src/handlers/tasks/background-automation-slack.ts

@@ -21,13 +21,15 @@ type ScheduledSuggestionSurfaceConfig = {
     | 'suggested_tasks'
     | 'sentry_triage'
     | 'dependabot_triage'
+    | 'codeql_triage'
     | 'security_auditor'
     | 'code_quality_auditor'
     | 'ci_failure_triage';
   summaryKind:
     | 'suggested_tasks'
     | 'sentry_triage'
     | 'dependabot_triage'
+    | 'codeql_triage'
     | 'security_auditor'
     | 'code_quality_auditor'
     | 'ci_failure_triage';
@@ -44,6 +46,7 @@ export type ScheduledSuggestionSlackConfig = {
     | 'suggester'
     | 'sentry_triage'
     | 'dependabot_triage'
+    | 'codeql_triage'
     | 'security_auditor'
     | 'code_quality_auditor'
     | 'ci_failure_triage';
@@ -54,6 +57,7 @@ const SCHEDULED_SUGGESTION_SURFACE_CONFIG: Record<
   | 'suggester'
   | 'sentry_triage'
   | 'dependabot_triage'
+  | 'codeql_triage'
   | 'security_auditor'
   | 'code_quality_auditor'
   | 'ci_failure_triage',
@@ -119,6 +123,26 @@ const SCHEDULED_SUGGESTION_SURFACE_CONFIG: Record<
         'I went through the open Dependabot alerts for updates worth taking now, and a few low-risk ones stood out.',
     },
   },
+  codeql_triage: {
+    suggestionType: 'codeql_triage',
+    summaryKind: 'codeql_triage',
+    actionFooterText:
+      'I pulled the strongest CodeQL remediation candidates into the thread for review.',
+    prompt: {
+      automationDescription: 'a CodeQL triage automation',
+      mainActionLine: 'Summarize the CodeQL findings worth fixing.',
+      highlightLabel: 'CodeQL findings worth fixing',
+      openerSignal: 'a CodeQL / code-scanning alert triage pass',
+      openerExamples: [
+        'I went through the open CodeQL alerts for security findings worth fixing before they pile up',
+        'I did a CodeQL pass, separating the high-confidence insecure patterns from noisier static findings',
+        'I triaged the current code-scanning alerts, watching for anything with real security exposure',
+      ],
+      overflowLabel: 'CodeQL finding',
+      fallbackLead:
+        'I went through the open CodeQL alerts for security findings worth fixing now, and a few stood out.',
+    },
+  },
   security_auditor: {
     suggestionType: 'security_auditor',
     summaryKind: 'security_auditor',
@@ -197,6 +221,7 @@ function getScheduledSuggestionSurfaceConfig(
     automationKey === 'suggester' ||
     automationKey === 'sentry_triage' ||
     automationKey === 'dependabot_triage' ||
+    automationKey === 'codeql_triage' ||
     automationKey === 'security_auditor' ||
     automationKey === 'code_quality_auditor' ||
     automationKey === 'ci_failure_triage'

apps/api/src/handlers/tasks/submitTaskSuggestions.ts

@@ -148,6 +148,7 @@ type TaskSuggestionType =
   | 'suggested_tasks'
   | 'sentry_triage'
   | 'dependabot_triage'
+  | 'codeql_triage'
   | 'security_auditor'
   | 'code_quality_auditor'
   | 'ci_failure_triage';

apps/bullmq/src/scheduler.ts

@@ -3,6 +3,7 @@ import { Queue, QueueEvents, Worker, Job } from 'bullmq';
 import {
   announcerJob,
   codeQualityAuditorJob,
+  codeqlTriageJob,
   conflictScanJob,
   dependabotTriageJob,
   managerStatsJob,
@@ -61,6 +62,7 @@ const AUTOMATION_JOBS: Record<
   manager_stats: managerStatsJob,
   sentry_triage: sentryTriageJob,
   dependabot_triage: dependabotTriageJob,
+  codeql_triage: codeqlTriageJob,
   security_auditor: securityAuditorJob,
   code_quality_auditor: codeQualityAuditorJob,
 };
@@ -126,6 +128,11 @@ async function createJobs(queue: Queue): Promise<void> {
     { every: 60 * 60 * 1000 }, // Every 60 minutes.
   );
 
+  await queue.upsertJobScheduler(
+    'codeql_triage' satisfies ScheduledAutomationJobName,
+    { every: 60 * 60 * 1000 }, // Every 60 minutes.
+  );
+
   await queue.upsertJobScheduler(
     'security_auditor' satisfies ScheduledAutomationJobName,
     { every: 60 * 60 * 1000 }, // Every 60 minutes.

apps/docs/automations.mdx

@@ -79,6 +79,7 @@ manager-facing updates and suggestions.
 | **Weekly Manager Stats**     | A weekly summary of Roomote activity                             | Weekly                                      |
 | **Triage Sentry Issues**     | Prioritized Sentry follow-up work                                | Daily or weekly                             |
 | **Triage Dependabot Alerts** | Suggested follow-up tasks for open dependency alerts             | Daily or weekly                             |
+| **Triage CodeQL Alerts**     | Remediation follow-up tasks for open code-scanning / CodeQL alerts | Daily or weekly                           |
 | **Security Auditor**         | Security follow-up work from recently merged PRs                 | Every hour, every 6 hours, daily, or weekly |
 | **Code Quality Auditor**     | Code quality follow-up work from recently merged PRs             | Every hour, every 6 hours, daily, or weekly |
 | **Suggest Ideas**            | Useful coding work Roomote thinks the team could do              | Daily or weekly                             |
@@ -100,11 +101,11 @@ surfaces).
 
 Cards also show capability badges for what each automation supports today:
 the chat surfaces it can report to and the source-control providers it works
-with. Triage Dependabot Alerts and CI Failure Triage are GitHub-only by
-nature. Security Auditor, Code Quality Auditor, Weekly Manager Stats, Suggest
-Ideas, Summarize Merged PRs, and Triage Sentry Issues work with any connected
-source-control provider. Resolve PR Conflicts supports GitHub, GitLab, and
-Azure DevOps.
+with. Triage Dependabot Alerts, Triage CodeQL Alerts, and CI Failure Triage are
+GitHub-only by nature. Security Auditor, Code Quality Auditor, Weekly Manager
+Stats, Suggest Ideas, Summarize Merged PRs, and Triage Sentry Issues work with
+any connected source-control provider. Resolve PR Conflicts supports GitHub,
+GitLab, and Azure DevOps.
 
 **Code Quality Auditor** inspects recently merged PR diffs and only posts
 high-confidence maintainability issues worth a real follow-up task. It is
@@ -120,6 +121,11 @@ projects.
 active repositories and suggests tightly scoped follow-up update tasks. It
 does not open PRs directly from the scheduled scan.
 
+**Triage CodeQL Alerts** scans open GitHub code-scanning alerts (especially
+CodeQL findings) across your active repositories and launches tightly scoped
+remediation follow-up tasks. It does not open PRs directly from the scheduled
+scan.
+
 **Security Auditor** reviews recently merged PRs for concrete security issues
 and secure-by-default gaps that are worth a real follow-up task.
 

apps/docs/providers/source-control/github.mdx

@@ -77,6 +77,7 @@ Grant these repository permissions:
 - **Commit statuses**: Read-only
 - **Deployments**: Read-only
 - **Dependabot alerts**: Read-only
+- **Code scanning alerts**: Read-only
 - **Issues**: Read and write
 - **Metadata**: Read-only
 - **Pull requests**: Read and write