Remove the `labeled` trigger type from pull_request_target and the
associated `verified` label guard from the if condition. The check
now fires on opened and synchronize only, without requiring a label.

infra[notask]: add qvac-ci pending-approval workflow and CODEOWNERS

…r in check-approvals (#15)

…CodeQL) to qvac-ext-stable-diffusion.cpp (#17)

* QVAC-21550 infra: add canonical security baseline caller (TruffleHog + CodeQL)

* QVAC-21550 fix: drop paths-exclude (unsupported by reusable security v0)

* QVAC-21550 fix: buildless CodeQL (codeql-build-mode: none) via qvac-actions#10

* QVAC-21550 fix: drop secrets: inherit (baseline needs no repo secrets; github.token suffices)

* QVAC-21550 fix: repin security baseline to qvac-actions 0.2.0 (buildless c-cpp)

The canonical CodeScan baseline currently runs on push/PR only, so the
QVAC-19056 commitment to a weekly scan is unmet. Add a scheduled cron
(staggered per repo across the fleet) alongside the existing
push / pull_request / workflow_dispatch triggers. No other change.

Bump the reusable security workflow pin 0.2.0 -> 0.3.0 (SHA bbb0740e). 0.3.0
adds the findings-export artifact (export-report default on), so each run now
publishes a downloadable security-scan-report (findings.json/md + SARIF).

Add .github/runners.yaml as the single source of truth for specialized CI runner labels, a generated reusable-runner-names workflow that exports them as job outputs, and sync/validate scripts with unit tests. Wire build.yml's Windows jobs to consume the output instead of hardcoding windows-2022. Rolling -latest aliases and matrix.os identities stay hardcoded.

build.yml's group fell back to github.run_id whenever head_ref was empty, so pushes and dispatches never cancelled. Key on the PR number, then on the publish predicate, then the ref. Anything that publishes is exempt and keyed per run: every publish gate has a branch-free disjunct (github.event.inputs.create_release == 'true'), so a create_release dispatch publishes from any ref and must never be superseded mid-uploadReleaseAsset. runner-names-validate gains a block.

…ready runs (#45)

* QVAC-24501 fix: unignore .github/scripts/test and add the tests CI already runs

runner-names-validate.yml has always had this step:

  - name: Unit tests
    run: node --test .github/scripts/test/runner-names.test.mjs

but that file is not in the repo, and `node --test` on a missing path exits 1.
The workflow has therefore failed on every run since infra/runner-label-catalog
introduced it on 2026-09-01 - master included, and throughout the QVAC-24629
concurrency branch. Run 34256435445 on master shows the shape:

  validate-runner-names: ok (1 targets, 1 workflow(s))
  ##[error]Process completed with exit code 1

The validator passes. The step after it is what fails. A check that is
permanently red is also a silent one: nothing here has ever been enforced by a
green run.

ROOT CAUSE

.gitignore line 3 is a bare `test/`. An unanchored directory pattern matches at
ANY depth, so it covers .github/scripts/test/ as well as the local build scratch
dir it is grouped with (build*/, cmake-build-*/, .cache/). Whoever added the
workflow step almost certainly wrote the test file too and git silently refused
it. None of the other five engine repos carry this rule.

Kept the broad rule rather than anchoring it to /test/ - a nested test/
elsewhere in the tree may rely on it - and re-included just the CI path. The
directory itself has to be re-included, because git cannot re-include a file
whose parent directory is excluded. Verified: test/x.cpp and examples/test/y.cpp
are both still ignored, .github/scripts/test/ is not.

THE TESTS

Ported from qvac-ext-bergamot-translator, whose lib/runner-names.mjs is
identical to this one apart from the repo name and the ADDON_WORKFLOWS set, and
which is hosted-only like this repo. Adapted to this catalog (windows_2022),
plus two assertions specific to it:

- The catalog stays hosted-only. This repo runs entirely on GitHub images and
  has no reusable-authorize-self-hosted.yml, so a self-hosted entry appearing
  here would put fork PRs on a self-hosted runner with no fork-ci gate. The
  self-hosted engine repos all carry that gate; this one has nothing to carry
  it with. Checked the guard fires rather than passing vacuously.
- The validated allowlist is non-empty and still contains build.yml. A wired
  workflow missing from ADDON_WORKFLOWS is not checked at all, which would make
  every other assertion in this file vacuous.

  node --test .github/scripts/test/runner-names.test.mjs -> 11 passed, 0 failed
  node .github/scripts/validate-runner-names.mjs -> ok (1 targets, 1 workflow(s))

No workflow or catalog change. QVAC-24501's runner repoint does not apply here:
every runs-on in this repo is ubuntu-latest, macos-latest or windows-2022, so
there is no unroutable self-hosted label of the kind fixed in fabric-llm and
ext-ggml. This closes the guardrail gap instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: trim comments to the non-obvious bits

The gitignore rationale belongs in the commit and PR, not inline next to a
one-line negation. The hosted-only test's comment restated its own name and
assert message.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>