ci: restore CI - use large runners, disable non-allowlisted actions

CI on this repo has been dead since 2025-12-19. Every run on every branch
failed with `startup_failure` at 0s. Two independent causes, both verified:

1. `runs-on: ubuntu-latest` no longer gets a runner allocated. The last green
   run (2025-12-19) was served by runner group "GitHub Actions"; today an
   identical job sits queued indefinitely with an empty runner group. This
   repo is public, so it uses the GitHub-hosted larger-runner labels.
   Verified: `ubuntu-latest` queued >6min; `ubuntu-latest-large` picked up a
   runner in seconds and went green in 34s.

2. This repo's Actions policy permits only GitHub-owned `actions/*`
   (`allowed_actions: selected`, `patterns_allowed: []`,
   `verified_allowed: false`) and enforces `sha_pinning_required: true`.
   Referencing `snyk/actions/node` or `codecov/codecov-action` fails the whole
   run at startup, regardless of pinning.

So: switch to `ubuntu-latest-large`, and comment out the two third-party
action steps with TODOs explaining how to restore them. Both are commented,
not deleted, and keep their SHA-pinned refs so re-enabling is a one-line
change once the actions are allowlisted via the SSC Help portal.

Snyk is a security step and Codecov backs non-informational coverage gates in
codecov.yml — neither should stay disabled untracked. This follows the same
disable-with-TODO pattern used in segmentio/fql's locked-down pipeline.

Author: MichaelGHSeg

.github/workflows/ci.yml

@@ -4,7 +4,12 @@ on: [push]
 
 jobs:
   test-and-build:
-    runs-on: ubuntu-latest
+    # fql-ts is a public repo, so it runs on GitHub-hosted runners. Plain
+    # `ubuntu-latest` no longer gets allocated one — jobs sit queued forever.
+    # Public repos use the larger-runner labels. Verified: `ubuntu-latest`
+    # queued >6min with an empty runner group; `ubuntu-latest-large` picked up
+    # a runner in seconds.
+    runs-on: ubuntu-latest-large
 
     strategy:
       matrix:
@@ -21,26 +26,47 @@ jobs:
       - name: Install Dependencies
         run: yarn install --frozen-lockfile
 
-      - name: Run Snyk to check for vulnerabilities
-        # Was `@master` — a mutable branch ref on a third-party action running
-        # with SNYK_TOKEN in scope. Pinned to the v1.0.0 release commit.
-        # NOTE: this action is Docker-based and still pulls the mutable
-        # `docker://snyk/snyk:node` image at runtime, so the SHA pin bounds the
-        # action code but not the scanner image.
-        uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          args: --severity-threshold=high --fail-on=upgradable
+      # TODO: re-enable Snyk scanning. This repo's Actions policy allows only
+      # GitHub-owned `actions/*` (`patterns_allowed: []`,
+      # `verified_allowed: false`), so referencing `snyk/actions/node` at all
+      # fails the whole run with `startup_failure` before any step executes.
+      # This is a SECURITY step — it must not stay disabled untracked.
+      #
+      # To restore: get `snyk/actions/*` added to the repo/org allowlist via the
+      # SSC Help portal, then uncomment. The ref below is already SHA-pinned to
+      # satisfy `sha_pinning_required: true` (it was previously `@master` — a
+      # mutable branch ref on a third-party action running with SNYK_TOKEN in
+      # scope, which is why it should not be restored as `@master`).
+      #
+      # Caveat for whoever re-enables it: this action is Docker-based and pulls
+      # the mutable `docker://snyk/snyk:node` image at runtime, so the SHA pin
+      # bounds the action code but not the scanner image.
+      #
+      # - name: Run Snyk to check for vulnerabilities
+      #   uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
+      #   env:
+      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      #   with:
+      #     args: --severity-threshold=high --fail-on=upgradable
 
       - name: Lint
         run: yarn lint
 
       - name: Test
         run: yarn test --coverage
 
-      - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          slug: segmentio/fql-ts
+      # TODO: re-enable the Codecov upload. Blocked by the same Actions policy as
+      # the Snyk step above — `codecov/codecov-action` is not GitHub-owned, so
+      # referencing it fails the run at startup.
+      #
+      # Note `codecov.yml` sets non-informational gates (93.14% project / 80%
+      # patch). With no upload, those checks have no data to report against, so
+      # this must be restored before relying on coverage as a merge gate.
+      #
+      # To restore: get `codecov/codecov-action@*` allowlisted, then uncomment.
+      #
+      # - name: Upload coverage reports to Codecov
+      #   uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+      #   with:
+      #     token: ${{ secrets.CODECOV_TOKEN }}
+      #     slug: segmentio/fql-ts