ci: support full validation on workflow_dispatch (no PR context)

The Build CodeQL Packs workflow (ci.yml) previously assumed every run had
a PR context (github.event.number). For workflow_dispatch runs this value
is empty, which caused two problems:

1. Unquoted script arguments (pr-compile.sh, pr-suites-packs.sh) meant an
   empty github.event.number was dropped entirely by bash word-splitting,
   shifting the language argument into position 1 and leaving position 2
   unset - crashing immediately under set -u ("unbound variable") before
   any query compilation happened.
2. Every step was gated on dorny/paths-filter's src output, which is
   PR-diff-based and not meaningful for a manual "verify everything" run.

Fixes:
- Quote the PR-number/language args passed to pr-compile.sh and
  pr-suites-packs.sh so an empty value is passed as an explicit empty
  string instead of vanishing.
- Add || github.event_name == 'workflow_dispatch' to every
  steps.changes.outputs.src == 'true' step condition (12 occurrences
  across compile-and-test, extensions, library-sources, and configs jobs)
  so a manual dispatch always runs every step regardless of path-filter.
- Give pr-compile.sh, pr-suites-packs.sh, and pr-configs.sh a "full mode"
  fallback that activates whenever PR_NUMBER is empty: instead of calling
  gh pr view / gh pr comment (which require a PR), each script now
  enumerates the relevant files directly from the filesystem (full
  --warnings=error compile of the language, find over suites/*.qls,
  glob over configs/*.yml) and skips any PR-comment logic. This keeps a
  single dual-mode script per concern instead of forking separate
  PR/non-PR script files, avoiding future logic drift between the two
  paths.

This lets ci.yml be dispatched manually on any branch (including main)
to get a real, full compile-and-test validation without requiring an
open pull request - closing the validation gap that let PR #179 get
merged on the strength of the wrong CI signal.

Author: felickz

.github/scripts/pr-compile.sh

@@ -1,14 +1,24 @@
 #!/bin/bash
 set -euo pipefail
 
-PR_NUMBER=${1}
+PR_NUMBER=${1:-}
 LANGUAGE=${2}
 # to stop recompiling all queries if multiple files are modified
 LIBRARY_SCANNED=false
 
 echo "[+] Compiling all queries in $LANGUAGE"
 codeql query compile --threads=0 --check-only "./$LANGUAGE/"
 
+if [[ -z "$PR_NUMBER" ]]; then
+    # No PR context (e.g. workflow_dispatch run directly on a branch) - there is no PR
+    # file list to walk, so do a full strict compile (--warnings=error) of every query
+    # in the language instead. This is at least as strict as the per-file PR-mode loop below.
+    echo "[+] No PR number provided - running full strict compile (--warnings=error) for $LANGUAGE"
+    codeql query compile --threads=0 --check-only --warnings=error "./$LANGUAGE/"
+    echo "[+] Complete"
+    exit 0
+fi
+
 for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     if [[ ! -f "$file" ]]; then
         continue
@@ -31,4 +41,4 @@ for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     fi
 done
 
-echo "[+] Complete"
+echo "[+] Complete"

.github/scripts/pr-configs.sh

@@ -1,31 +1,48 @@
 #!/bin/bash
 set -euo pipefail
 
-PR_NUMBER=${1}
+PR_NUMBER=${1:-}
 
 codeql_code="/tmp/codeql-test-code"
 codeql_db="/tmp/codeql-test-database"
 
-for file in $(gh pr view $PR_NUMBER --json files --jq '.files.[].path'); do
+compile_config() {
+    local file=$1
+    echo "[+] Compiling Config :: $file"
+
+    if [[ -d "$codeql_db" ]]; then
+        rm -rf "$codeql_db"
+    fi
+
+    mkdir -p "$codeql_code"
+    echo "print('Hello, World!')" > "$codeql_code/main.py"
+
+    codeql database create \
+        --source-root=$codeql_code \
+        --language=python \
+        --codescanning-config=$file \
+        "$codeql_db"
+}
+
+if [[ -z "$PR_NUMBER" ]]; then
+    # No PR context (e.g. workflow_dispatch run directly on a branch) - there is no PR
+    # file list to walk, so validate every config directly from the filesystem instead.
+    echo "[+] No PR number provided - validating all configs/*.yml"
+    for file in configs/*.yml; do
+        [[ -f "$file" ]] || continue
+        compile_config "$file"
+    done
+    echo "[+] Complete"
+    exit 0
+fi
+
+for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     if [[ ! -f "$file" ]]; then
         continue
     fi
 
     # config file
     if [[ "$file" == configs/*.yml ]]; then
-        echo "[+] Compiling Config :: $file"
-
-        if [[ -d "$codeql_db" ]]; then
-            rm -rf "$codeql_db"
-        fi
-
-        mkdir -p "$codeql_code"
-        echo "print('Hello, World!')" > "$codeql_code/main.py"
-
-        codeql database create \
-            --source-root=$codeql_code \
-            --language=python \
-            --codescanning-config=$file \
-            "$codeql_db"
+        compile_config "$file"
     fi
-done
+done

.github/scripts/pr-suites-packs.sh

@@ -1,10 +1,32 @@
 #!/bin/bash
 set -euo pipefail
 
-PR_NUMBER=${1}
+PR_NUMBER=${1:-}
 LANGUAGE=${2}
 PACK_COMPILED=false
 
+if [[ -z "$PR_NUMBER" ]]; then
+    # No PR context (e.g. workflow_dispatch run directly on a branch) - there is no PR
+    # file list to walk, so resolve every suite and (re)build the language's packs
+    # directly. There is no PR to comment on, so the version-diff-comment logic below
+    # is intentionally skipped in this mode.
+    echo "[+] No PR number provided - running full suite/pack validation for $LANGUAGE"
+
+    if [[ -d "$LANGUAGE/suites" ]]; then
+        while IFS= read -r -d '' suite; do
+            echo "[+] Compiling Suite: $suite"
+            codeql resolve queries "$suite"
+        done < <(find "$LANGUAGE/suites" -name '*.qls' -print0)
+    fi
+
+    echo "[+] Compiling Pack: $LANGUAGE"
+    codeql pack install "$LANGUAGE"
+    codeql pack create "$LANGUAGE"
+
+    echo "[+] Complete"
+    exit 0
+fi
+
 for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     if [[ ! -f "$file" ]]; then
         continue
@@ -72,4 +94,4 @@ for file in $(gh pr view "$PR_NUMBER" --json files --jq '.files.[].path'); do
     fi
 done
 
-echo "[+] Complete"
+echo "[+] Complete"

.github/workflows/ci.yml

@@ -37,12 +37,12 @@ jobs:
               - '.github/**'
 
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         id: install-codeql
         uses: ./.github/actions/install-codeql
 
       - name: Install Packs
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
           CODEQL_CLI_VERSION: ${{ steps.install-codeql.outputs.codeql-cli-version }}
@@ -53,14 +53,14 @@ jobs:
           codeql pack install "${{ matrix.language }}/test"
 
       - name: Compile Queries
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          ./.github/scripts/pr-compile.sh ${{ github.event.number }} ${{ matrix.language }}
+          ./.github/scripts/pr-compile.sh "${{ github.event.number }}" "${{ matrix.language }}"
 
       - name: Test Queries
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           RUNNER_TEMP: ${{ runner.temp }}
         shell: python
@@ -110,7 +110,7 @@ jobs:
               file.close()
 
       - name: Upload test results
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.language }}-test-results
@@ -119,11 +119,11 @@ jobs:
           if-no-files-found: error
 
       - name: Compile / Check Suites & Packs
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          ./.github/scripts/pr-suites-packs.sh ${{ github.event.number }} ${{ matrix.language }}
+          ./.github/scripts/pr-suites-packs.sh "${{ github.event.number }}" "${{ matrix.language }}"
 
   validate-test-results:
     name: Validate test results
@@ -180,11 +180,11 @@ jobs:
               - '${{ matrix.language }}/ext/**'
 
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: ./.github/actions/install-codeql
 
       - name: Install Packs
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
@@ -213,11 +213,11 @@ jobs:
               - '${{ matrix.language }}/ext-library-sources/**'
 
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: ./.github/actions/install-codeql
 
       - name: Install CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
@@ -242,12 +242,12 @@ jobs:
               - 'configs/**'
       
       - name: Setup CodeQL
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         uses: ./.github/actions/install-codeql
 
       - name: "Check Configurations"
-        if: steps.changes.outputs.src == 'true'
+        if: steps.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch'
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          ./.github/scripts/pr-configs.sh "${{ github.event.number }}"
+          ./.github/scripts/pr-configs.sh "${{ github.event.number }}"