fix: delete stray codeql.yml (compliance #66)

[don-petry]

Summary

• Deletes .github/workflows/codeql.yml to bring the repo into compliance with the org standard for GitHub-managed CodeQL default setup
• The file contained no custom query packs, build modes, or path filters that would require a documented exception
• Previous PRs ci: remove stray codeql.yml workflow #76 and ci: remove stray codeql.yml workflow #85 addressed the same issue but were not merged; the file was re-introduced via Dependabot bump (chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 #84)

Closes #66

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 10 minutes and 14 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 38ce6939-946e-489b-8a06-17a4d9eb902c

📥 Commits

Reviewing files that changed from the base of the PR and between 9b1d0c2 and 72dec1e.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-66-20260419-1606

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review

This PR makes a single change: deletes .github/workflows/codeql.yml.

Review checklist:

• The deleted file was a standard CodeQL workflow scanning only the actions ecosystem
• No custom query packs, build modes, or path filters were present — no exception documentation is required
• No other files in the repo reference this workflow
• The org now provides CodeQL analysis via GitHub-managed default setup, making this file redundant drift

The change is correct and complete.

---

@don-petry — you're the code owner for this repo. This PR addresses the long-standing compliance finding in issue #66. Previous PRs #76 and #85 made the same change but were never merged; Dependabot re-bumped the file in the interim via #84. Please review and merge to resolve the compliance issue.

[Copilot]

Pull request overview

Removes the repository-level CodeQL GitHub Actions workflow to align with the organization standard of using GitHub-managed CodeQL default setup (avoiding duplicate analyses) and close compliance issue #66.

Changes:

• Deleted .github/workflows/codeql.yml (no custom query packs, build modes, or path filters retained).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Outdated review (superseded by re-review at c071db52242449bef37175096d7d251671834f05) — click to expand.

Automated review — APPROVED

Risk: LOW
Reviewed commit: 386f3e4c2dca9be13745a072a341b6e9e2af1315
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

Single deletion of .github/workflows/codeql.yml to comply with the org standard requiring GitHub-managed CodeQL default setup. The org-managed CodeQL continues to run (confirmed by the passing Analyze (actions) and CodeQL status checks on this PR), so security scanning coverage is uninterrupted. All CI gates pass; SonarCloud reports 0 new issues and 0 security hotspots.

Findings

Info

• .github/workflows/codeql.yml — This is the third attempt (after unmerged PRs ci: remove stray codeql.yml workflow #76 and ci: remove stray codeql.yml workflow #85) to close compliance finding Compliance: stray-codeql-workflow #66. The file was re-introduced by Dependabot (chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 #84) after prior attempts; no blocker exists now.
• .github/workflows/codeql.yml — The deleted workflow scanned the actions language ecosystem. The org-managed CodeQL default setup is confirmed active: Analyze (actions) and CodeQL checks both passed on this PR, so no coverage gap is introduced.
• All status checks pass: Lint, Format, AgentShield, CodeQL (org-managed), SonarCloud (Quality Gate passed, 0 security hotspots), Dependency audit. CodeRabbit hit a rate limit but returned an overall success status.

CI status

All status checks pass: Lint, Format, AgentShield, CodeQL (org-managed), SonarCloud (Quality Gate passed, 0 security hotspots), Dependency audit.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[don-petry]

Outdated review (superseded by re-review at c071db52242449bef37175096d7d251671834f05) — click to expand.

Automated review — APPROVED

Risk: LOW
Reviewed commit: 291758d1d4de291bae4070778657d51d420a85f3
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

Single deletion of .github/workflows/codeql.yml to comply with the org standard requiring GitHub-managed CodeQL default setup. The org-managed CodeQL continues to run (both Analyze (actions) and CodeQL checks pass on this PR), so there is no security scanning coverage gap. All CI gates pass and SonarCloud reports 0 new issues and 0 security hotspots.

Findings

Info

• [info] .github/workflows/codeql.yml — Third attempt (after unmerged PRs ci: remove stray codeql.yml workflow #76 and ci: remove stray codeql.yml workflow #85) to close compliance finding Compliance: stray-codeql-workflow #66. Dependabot re-introduced the file via chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 #84 after prior attempts; no blocker remains now.
• [info] .github/workflows/codeql.yml — Deleted workflow scanned only the 'actions' language ecosystem with all action refs pinned to commit SHAs. Org-managed CodeQL default setup covers the same scope; both 'Analyze (actions)' and 'CodeQL' checks passed on the current HEAD — no coverage gap introduced.
• [info] CI — Current HEAD (291758d) is a merge commit bringing branch up to date with main; no new file changes beyond the original deletion at 386f3e4. All CI checks pass: Analyze (actions) SUCCESS, CodeQL SUCCESS, CodeRabbit SUCCESS, SonarCloud Quality Gate passed (0 security hotspots).
• [info] merge-state — mergeStateStatus is BLOCKED only because reviewDecision is REVIEW_REQUIRED (human approval pending). No CI failures or merge conflicts; the branch is mergeable.

CI status

All CI checks pass: Analyze (actions) SUCCESS, CodeQL SUCCESS, CodeRabbit SUCCESS, SonarCloud Quality Gate passed (0 security hotspots).

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated approval after review posting fix

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 75d21f717a500fc0bb87e3aed469ebcdfdeb5829
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)

Summary

Single deletion of .github/workflows/codeql.yml to comply with the org standard requiring GitHub-managed CodeQL default setup. The org-managed CodeQL continues to run (both 'Analyze (actions)' and 'CodeQL' checks pass on the current HEAD), so no security scanning coverage gap is introduced. All CI gates pass and SonarCloud reports 0 new issues and 0 security hotspots.

Findings

• INFO: Third attempt (after unmerged PRs #76 and #85) to close compliance finding #66. Dependabot re-introduced the file via #84 after prior attempts. No blocker remains now — org-managed CodeQL is confirmed active and all CI checks pass.
• INFO: The deleted workflow scanned only the 'actions' language ecosystem with all action refs pinned to commit SHAs. Org-managed CodeQL default setup covers the same scope; both 'Analyze (actions)' and 'CodeQL' status checks passed on the current HEAD — no coverage gap is introduced by this deletion.
• INFO: All status checks pass on HEAD 75d21f7: Lint SUCCESS, Format SUCCESS, AgentShield SUCCESS, Analyze (actions) SUCCESS, CodeQL SUCCESS, SonarCloud Quality Gate passed (0 security hotspots, 0 new issues), Dependency audit SUCCESS. mergeStateStatus is BLOCKED only because REVIEW_REQUIRED branch protection requires a human or bot approval — no CI failures or merge conflicts.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated review — human attention needed

This PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops.

Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the needs-human-review label and the cascade can be re-engaged on the next push.

Posted by the don-petry PR-review cascade.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Closing — after rebasing onto main, this branch has no remaining commits. The fix was already incorporated into main via a subsequent PR.