ci: cut a duplicate check job and de-flake the frontend suite

[thegdsks]

Summary

Two real problems, not just check-list noise: Detect changed areas ran twice on every single push/PR (ci.yml and codeql.yml each independently computed the same backend/frontend path split on a separate runner), and the frontend test suite has genuinely flaked (RamFitBadge.test.tsx, repeatedly, requiring manual reruns this session) under CI's default vitest per-file parallelism.

codeql.yml: moved path filtering from a runtime dorny/paths-filter job to the workflow trigger itself (on.push.paths/on.pull_request.paths). An irrelevant PR (workflow-only, docs-only) now never even queues a runner for this workflow, instead of queuing one just to decide to skip it. Tradeoff, stated plainly: a path-scoped trigger can't tell which language changed, only that something relevant did, so both the Go and JS/TS CodeQL scans now run together whenever this workflow runs, instead of each being independently skippable. Acceptable since CodeQL was never a required, merge-blocking check, only a security-scan signal.

web/vitest.config.ts: fileParallelism: false. Every test file getting its own jsdom environment (vitest's default) contends for CPU on a resource-constrained runner badly enough that a React Query-driven async assertion (findByText) has repeatedly missed its default timeout — a resource-contention flake with nothing to do with the component or test logic, the exact class of issue this repo's own local dev workflow already works around case by case with a --no-file-parallelism flag. Making it the actual config default means every invocation (CI's plain npm test, anyone's local npm test) gets the reliable behavior without needing to remember a flag.

What this does not do

• Does not touch ci.yml itself; its own changes job stays as the single source of truth for the backend/frontend split used by the required build/test/lint jobs.
• Does not reduce or disable any of the 6 actually-required branch-protection checks (Build/vet, Lint, Test x2, Coverage gate, Web).
• Does not touch external GitHub App integrations shown in the PR checks list (SonarCloud, CodeRabbit, Greptile Review) — those aren't defined in this repo's workflow files at all, they're configured at the GitHub App installation level, out of scope for a workflow-file change.

Test plan

• Full local frontend suite with the new config: 234/234 tests passing reliably (multiple consecutive runs, ~50-65s each)
• npx tsc --noEmit: clean
• codeql.yml YAML syntax validated
• Pre-commit hook (gofmt, vet, lint, build, web checks) passed

[coderabbitai]

Warning

Review limit reached

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c468e767-1dde-4c34-9496-140f98ecb01c

📥 Commits

Reviewing files that changed from the base of the PR and between fa92d67 and ea8ad8a.

📒 Files selected for processing (2)

• .github/workflows/codeql.yml
• web/vitest.config.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no actionable correctness, security, or repository-rule issues identified.

Summary

This PR removes CodeQL’s duplicate runtime path-filtering job and makes frontend test-file execution serial by default.

• Moves CodeQL source-path filtering to push and pull-request triggers.
• Runs both Go and JavaScript/TypeScript analyses whenever a relevant source path triggers the workflow.
• Preserves both-language execution for scheduled and manually dispatched scans.
• Disables Vitest file parallelism to reduce resource-contention flakes.

_{Reviews (1) · Last reviewed commit: "ci: cut a duplicate check job and de-fla..."}