ci: restore C++ CodeQL analysis (dynamic workflow is python-only since 2026-08-08)

.github/workflows/README.md

@@ -9,6 +9,9 @@ security scanning of the Keystone HMAS (Hierarchical Multi-Agent System) codebas
 
 - **`_required.yml`** emits the baseline required contexts, including lint,
   build, test, package, security, schema, and dependency-version checks.
+- **`codeql.yml`** is the fleet-standard CodeQL analysis workflow for C++ and
+  Python (weekly schedule); it replaces the `analyze` job formerly in
+  `_required.yml` (#655).
 - **`extras.yml`** emits the separately required `coverage` context and advisory
   benchmark/NATS checks.
 - **`release-please.yml`** manages releases after pushes to `main`.

.github/workflows/_required.yml

@@ -996,71 +996,3 @@ jobs:
           fail_ci_if_error: false
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  # ============================================================
-  # 22. analyze  (restored CodeQL, see commit 79e8e0e)
-  #    The consolidation deleted codeql-analysis.yml but never added the
-  #    Analyze job to this file, so C++ had no CodeQL coverage and the
-  #    cpp/unused-* alerts from the old workflow could never auto-close.
-  #    Restored from the deleted workflow (c-cpp manual build + python).
-  # ============================================================
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: c-cpp
-            build-mode: manual
-          - language: python
-            build-mode: none
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3  # v3
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-          queries: security-and-quality
-          config-file: ./.github/codeql/codeql-config.yml
-
-      # C++ manual build steps -- only run for c-cpp
-      - name: Install build dependencies
-        if: matrix.language == 'c-cpp'
-        uses: ./.github/actions/install-build-deps
-        with:
-          cache-conan: "true"
-
-      - name: Cache FetchContent downloads
-        if: matrix.language == 'c-cpp'
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
-        with:
-          path: build/codeql/_deps
-          key: fetchcontent-codeql-${{ runner.os }}-${{ hashFiles('CMakeLists.txt') }}
-          restore-keys: |
-            fetchcontent-codeql-${{ runner.os }}-
-
-      - name: Install Conan dependencies
-        if: matrix.language == 'c-cpp'
-        run: conan install . --output-folder=build/codeql/conan-deps --build=missing -s build_type=Release -s compiler.cppstd=20
-
-      - name: Build for CodeQL analysis
-        if: matrix.language == 'c-cpp'
-        run: |
-          cmake -S . -B build/codeql -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=build/codeql/conan-deps/conan_toolchain.cmake
-          cmake --build build/codeql
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3  # v3
-        with:
-          category: "/language:${{ matrix.language }}"

.github/workflows/codeql.yml

@@ -0,0 +1,100 @@
+# Fleet-standard CodeQL analysis for Keystone (C++ + Python).
+#
+# Restores a committed, dedicated CodeQL workflow per HomericIntelligence/Keystone#655:
+# the GitHub-managed dynamic workflow had degraded to python-only analysis, leaving
+# C++ uncovered. The proven manual-build `analyze` job from `_required.yml`
+# (restored by #657) moves here — mirroring the fleet-standard shape from the
+# HomericIntelligence/Odysseus#455 rollout — so CodeQL runs once with no duplicate
+# SARIF uploads under the same /language:* categories.
+#
+# The C++ build uses the Conan toolchain explicitly (autobuild cannot pass
+# -DCMAKE_TOOLCHAIN_FILE), and vendored dependencies under build/**/_deps/ are
+# excluded from analysis via .github/codeql/codeql-config.yml (#614).
+#
+# Pinned-contexts safety: verified via `gh api repos/HomericIntelligence/Keystone/rulesets?includes_parents=true`
+# that neither `Analyze (c-cpp)` nor `Analyze (python)` is a required_status_check —
+# ruleset 15556488 (`homeric-main-baseline`) pins lint, unit-tests, integration-tests,
+# security/dependency-scan, security/secrets-scan, build, schema-validation,
+# deps/version-sync, test, package, release, install; ruleset 18221122
+# (`homeric-main-extras`) pins coverage only. Moving this job out of `_required.yml`
+# therefore cannot brick the merge queue.
+
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 8 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: c-cpp
+            build-mode: manual
+          - language: python
+            build-mode: none
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3  # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-and-quality
+          config-file: ./.github/codeql/codeql-config.yml
+
+      # C++ manual build steps -- only run for c-cpp
+      - name: Install build dependencies
+        if: matrix.language == 'c-cpp'
+        uses: ./.github/actions/install-build-deps
+        with:
+          cache-conan: "true"
+
+      - name: Cache FetchContent downloads
+        if: matrix.language == 'c-cpp'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        with:
+          path: build/codeql/_deps
+          key: fetchcontent-codeql-${{ runner.os }}-${{ hashFiles('CMakeLists.txt') }}
+          restore-keys: |
+            fetchcontent-codeql-${{ runner.os }}-
+
+      - name: Install Conan dependencies
+        if: matrix.language == 'c-cpp'
+        run: conan install . --output-folder=build/codeql/conan-deps --build=missing -s build_type=Release -s compiler.cppstd=20
+
+      - name: Build for CodeQL analysis
+        if: matrix.language == 'c-cpp'
+        run: |
+          cmake -S . -B build/codeql -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=build/codeql/conan-deps/conan_toolchain.cmake
+          cmake --build build/codeql
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3  # v3
+        with:
+          category: "/language:${{ matrix.language }}"