From d9d35a6f76120492e0518842248c45946d9df33e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:53:28 +0000 Subject: [PATCH] ci(codeql): drop the workflow; CodeQL runs as GitHub default setup codeql.yml was disabled_manually and CodeQL now runs as GitHub's default setup, so the file, its two lock records (workflow entry and the v4.38.0 dependency, used by nothing else) and the dependabot hold on github/codeql-action are dead weight. No required status check names CodeQL (settings.yml contexts is empty); workflow-linter treats a missing codeql.yml as optional. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV --- .github/dependabot.yml | 8 ------ .github/workflows/README.adoc | 2 +- .github/workflows/actions.lock | 8 ------ .github/workflows/codeql.yml | 47 ---------------------------------- 4 files changed, 1 insertion(+), 64 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6a0f1b7..ae27f48 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -27,14 +27,6 @@ updates: # "security only, not routine bumps". Pair with the # dependabot-automerge.yml workflow for low-touch security # maintenance. - ignore: - # HOLD: github/codeql-action at v4.38.0 (commit b96794f0, held by - # .github/workflows/actions.lock). v4.38.1 fails - # GitHub workflow-startup validation estate-wide (nexia-list#100; - # SHA-form re-bump bypassed versions-scoped ignores - see - # nexia-list#101/#104). Hold until upstream clears 4.38.1 or a - # newer release verifies green; revisit deliberately. - - dependency-name: "github/codeql-action" - package-ecosystem: "cargo" directory: "/" diff --git a/.github/workflows/README.adoc b/.github/workflows/README.adoc index c7a2328..5f3adda 100644 --- a/.github/workflows/README.adoc +++ b/.github/workflows/README.adoc @@ -55,7 +55,7 @@ pins), and gitleaks in CI catches a genuine SonarCloud token as `generic-api-key == SAST tools are complementary, not redundant -* `codeql.yml` — CodeQL (matrix defaults to `actions`; every repo has workflows). +* CodeQL — GitHub's default setup (repository settings), not a workflow file here. * `sonarqube.yml` — SonarCloud (shell / JS surface; see `sonar-project.properties`). * `static-analysis-gate.yml` — panic-attack + Hypatia gate (see above). diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index b12aecc..09ce24e 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -5,9 +5,6 @@ version: 'v0.0.2' workflows: '.github/workflows/build-notification.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/codeql.yml': - - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.38.0' '.github/workflows/deed-validate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/deed-ecosystem@main' @@ -200,11 +197,6 @@ dependencies: commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938' owner_id: 9919 repo_id: 259445878 - 'github/codeql-action@v4.38.0': - ref: 'v4.38.0' - commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' - owner_id: 9919 - repo_id: 259445878 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406': ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406' commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 3e92dc1..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,47 +0,0 @@ -# This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 1 * *' # monthly 1st 06:00 UTC (Actions burn cut, standards#288) -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true -permissions: - contents: read -jobs: - analyze: - runs-on: ubuntu-latest - timeout-minutes: 15 - permissions: - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - include: - # Default to `actions` — scaffolded repos rarely have JS/TS - # failures on every CodeQL run. The `actions` extractor scans - # workflow files which every repo has. Override per-repo if - # the scaffolded project actually contains JS/TS code. - # Per hypatia rule `codeql_language_matrix_mismatch`. - - language: actions - build-mode: none - steps: - - name: Checkout - uses: actions/checkout@v7.0.1 - with: - persist-credentials: false - - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.0 # b96794f0 in actions.lock (4.38.1 blocked estate-wide; nexia-list#100) - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.0 # b96794f0 in actions.lock (4.38.1 blocked estate-wide; nexia-list#100) - with: - category: "/language:${{ matrix.language }}"