feat: create-check-run default true, codeql 4.37.7 combined bump

.github/workflows/codeql.yml

@@ -26,11 +26,11 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3
         with:
           languages: javascript-typescript
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v3
         with:
           category: '/language:javascript-typescript'

AGENTS.md

@@ -136,7 +136,11 @@ deleted after their content reached `main`; the stale pre-publication
 remain. Dependabot PRs #11 (`@types/node` 26), #13 (`vitest` 4) and #14
 (`@vitest/coverage-v8` 4) were merged on 2026-08-22 after local
 re-verification; PR #12 (`typescript` 7) stays open because `@vercel/ncc`
-cannot bundle under TS 7. The pre-release
+cannot bundle under TS 7. Dependabot Actions PRs #38 (`actions/setup-node` 7)
+and #39 (`actions/checkout` 7) were merged on 2026-08-23 after green CI, and
+the split CodeQL 4.37.7 PRs #35/#37 were superseded by a combined init+analyze
+bump; the `create-check-run` default flip also shipped in that PR. Every merge
+used the recorded admin-bypass pattern and is a maintainer decision. The pre-release
 [`v0.1.0-beta.2`](https://github.com/daichunghy/patchgate/releases/tag/v0.1.0-beta.2)
 was tagged at `main@edab0ec` on 2026-08-22 after a live maintainer smoke
 ([daichunghy/patchgate-beta-smoke](https://github.com/daichunghy/patchgate-beta-smoke))

action.yml

@@ -21,7 +21,7 @@ inputs:
   create-check-run:
     description: 'Whether to post an idempotent GitHub Check Run with the receipt summary.'
     required: false
-    default: 'false'
+    default: 'true'
   check-name:
     description: 'Title of the GitHub Check Run.'
     required: false

docs/github-action-usage.md

@@ -125,7 +125,7 @@ consumers should use the tagged Action above, not `uses: ./` after `npm ci`.
 |---|---|---|---|
 | `fail-on` | Status level causing step failure | `blocked` | `never`, `blocked`, `human_review_required`, `evidence_missing`, `policy_ambiguous` |
 | `github-token` | GitHub token for reading metadata; `checks: write` is also required when `create-check-run: true` | `${{ github.token }}` | String |
-| `create-check-run` | Post idempotent GitHub Check Run | `false` | `true`, `false` |
+| `create-check-run` | Post idempotent GitHub Check Run | `true` | `true`, `false` |
 | `check-name` | Title of the GitHub Check Run | `PatchGate Review Gate` | String |
 | `report-path` | Output path for `ContributionReceipt` | `patchgate-receipt.json` | Path string |
 

src/action/index.ts

@@ -40,7 +40,7 @@ export function parseActionInputs(env: NodeJS.ProcessEnv = process.env): ActionI
     failOn,
     githubToken: actionInput(env, "GITHUB-TOKEN", "GITHUB_TOKEN")?.trim() || env.GITHUB_TOKEN?.trim() || "",
     reportPath,
-    createCheckRun: (actionInput(env, "CREATE-CHECK-RUN", "CREATE_CHECK_RUN") ?? "").trim().toLowerCase() === "true",
+    createCheckRun: (actionInput(env, "CREATE-CHECK-RUN", "CREATE_CHECK_RUN") ?? "true").trim().toLowerCase() === "true",
     checkName,
   };
 }

test/action.test.ts

@@ -9,7 +9,7 @@ describe("GitHub Action runner unit tests", () => {
       expect(inputs.failOn).toBe("blocked");
       expect(inputs.githubToken).toBe("");
       expect(inputs.reportPath).toBe("patchgate-receipt.json");
-      expect(inputs.createCheckRun).toBe(false);
+      expect(inputs.createCheckRun).toBe(true);
       expect(inputs.checkName).toBe("PatchGate Review Gate");
     });