ci: remove drift codeql.yml — GitHub-managed default setup is active

[don-petry]

Summary

• Deletes .github/workflows/codeql.yml, which is drift per org CI standards §2
• GitHub-managed CodeQL default setup is already active (state=configured, languages=[actions], query_suite=default, last updated 2026-04-09)
• Per-repo codeql.yml files running alongside GitHub-managed setup double-bill CI minutes and are flagged as drift by the compliance audit

Why the compliance finding kept recurring

Previous attempts (PRs #75 and #92) each deleted this file and were never merged. Dependabot then bumped codeql-action in #84, which re-created the file on main. This PR removes it again from the current main HEAD.

The 403 errors in the compliance audit detail are a token-permissions issue on the audit side, not a misconfiguration — the default setup is and has been configured.

Standard reference

standards/ci-standards.md §2 – CodeQL Analysis (GitHub-managed default setup)

Closes #65

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 10 minutes and 26 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a9071d0f-24a3-4293-8186-9f6c6e5a7d98

📥 Commits

Reviewing files that changed from the base of the PR and between 9b1d0c2 and 457b67f.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-65-20260419-1606

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review complete — this is a straightforward deletion of a drift file with no logic to review. CI should be green (no workflow changes that could break anything).

@don-petry — you're the code owner. Please review and merge when ready.

[Copilot]

Pull request overview

Removes the repository-level CodeQL advanced setup workflow (.github/workflows/codeql.yml) to eliminate drift and avoid running duplicate CodeQL scans when GitHub-managed CodeQL default setup is already configured.

Changes:

• Deleted .github/workflows/codeql.yml (per-repo CodeQL workflow) to align with org CI standards and prevent duplicate scanning.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Outdated review (superseded by re-review at 62944c66ead249007aa5a44b6275bf0a87d0c69a) — click to expand.

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: c0114311cb05bb589537081bbb35539c2c8737cb
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

PR deletes a per-repo CodeQL workflow (.github/workflows/codeql.yml) on the grounds that GitHub-managed default setup is already active and the file constitutes org-standards drift. CI confirms CodeQL is still running successfully via the managed setup (both 'Analyze (actions)' and the 'CodeQL' status check are green). No code logic changes, no secrets, no regressions — the security scanning coverage is maintained.

Findings

Info

• [info] .github/workflows/codeql.yml — Deletion of per-repo codeql.yml is safe: GitHub-managed CodeQL default setup is demonstrably active — statusCheckRollup shows both 'Analyze (actions)' (workflowName: CodeQL) and 'CodeQL' checks passed with SUCCESS on this very PR's head commit.
• [info] Compliance: Issue Compliance: codeql-default-setup-not-configured #65 compliance finding shows 403 errors from the audit token, not actual misconfiguration. PR author's explanation (token-permissions issue on audit side) is consistent with the evidence. The default setup state=configured is corroborated by live CI results.
• [info] History: PRs ci: remove drift codeql.yml, enable GitHub-managed default setup #75 and ci: remove drift codeql.yml, enable GitHub-managed default setup #92 previously attempted this same deletion; Dependabot PR chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 #84 re-introduced the file by bumping codeql-action. This PR removes it cleanly from current HEAD. No recurrence risk since the managed setup removes the need for a per-repo file.

Minor

• [minor] .github/workflows/codeql.yml — The deleted workflow scanned only the 'actions' language. Verify the GitHub-managed default setup also covers 'actions' (confirmed: statusCheckRollup shows 'Analyze (actions)' as the managed-setup job name, so coverage is identical).

CI status

CI green — CodeQL checks passed (Analyze (actions) and CodeQL status checks both SUCCESS on head commit).

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[don-petry]

Outdated review (superseded by re-review at 62944c66ead249007aa5a44b6275bf0a87d0c69a) — click to expand.

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: 136edad725bf5631cf5e470053e96280d30e1a28
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

PR deletes .github/workflows/codeql.yml to fix org-standards drift; GitHub-managed CodeQL default setup is demonstrably active — statusCheckRollup shows both 'Analyze (actions)' (workflowName: CodeQL) and the 'CodeQL' status check passing with SUCCESS on the PR's head commit after the deletion. No code logic changes, no secrets, no regressions; SonarQube Quality Gate passed with 0 new issues and 0 security hotspots.

Findings

Info

• [info] .github/workflows/codeql.yml — Deletion of per-repo codeql.yml is safe: GitHub-managed CodeQL default setup is confirmed active. statusCheckRollup shows 'Analyze (actions)' (workflowName: CodeQL) and 'CodeQL' status check both SUCCESS on head commit 136edad — which is after the workflow file is removed. Coverage is maintained for the 'actions' language (same language the deleted workflow scanned).
• [info] (compliance) — Change is compliance-driven per org CI standards §2 (GitHub-managed default setup). Issue Compliance: codeql-default-setup-not-configured #65 compliance audit 403 errors are a token-scope issue on the audit side, not a misconfiguration — consistent with default setup state=configured evidenced by live CI results.
• [info] (history) — Previous PRs ci: remove drift codeql.yml, enable GitHub-managed default setup #75 and ci: remove drift codeql.yml, enable GitHub-managed default setup #92 attempted the same deletion but were never merged; Dependabot PR chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 #84 re-introduced the file. This PR removes it from current main HEAD. No recurrence risk since the GitHub-managed setup eliminates the need for a per-repo codeql.yml.
• [info] (prior-review) — An earlier automated cascade review approved this PR at SHA c011431 (MEDIUM risk). Current head is 136edad — the diff remains identical (same single file deletion, 34 deletions, 0 additions). No new concerns introduced.

CI status

All required checks passing: CodeQL (GitHub-managed default setup) SUCCESS, SonarQube Quality Gate passed with 0 new issues and 0 security hotspots.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated approval after review posting fix

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 7ef5985cd526ce96c6c6398a9f1a440e6ef5acfa
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)

Summary

PR deletes .github/workflows/codeql.yml to fix org-standards drift (CI standards §2). GitHub-managed CodeQL default setup is demonstrably active — statusCheckRollup shows both 'Analyze (actions)' (workflowName: CodeQL) and the 'CodeQL' status check passing with SUCCESS on the current head commit after the deletion. All required CI checks pass; SonarCloud Quality Gate passed with 0 new issues and 0 security hotspots. No logic changes, no secrets, no regressions.

Findings

• INFO: Deletion of per-repo codeql.yml is safe: GitHub-managed CodeQL default setup is confirmed active. statusCheckRollup shows 'Analyze (actions)' (workflowName: CodeQL) and 'CodeQL' status check both SUCCESS on head commit 7ef5985 — which is after the workflow file is removed. The deleted workflow scanned only the 'actions' language; managed setup covers the same language identically.
• INFO: Change is compliance-driven per org CI standards §2 (GitHub-managed default setup). Issue #65 compliance audit 403 errors are a token-scope issue on the audit side, not a misconfiguration — consistent with default setup state=configured evidenced by live CI results.
• INFO: Previous PRs #75 and #92 attempted the same deletion but were never merged; Dependabot PR #84 re-introduced the file. This PR removes it from current main HEAD. No recurrence risk since GitHub-managed setup eliminates the need for a per-repo codeql.yml.
• INFO: Two prior automated cascade reviews approved this PR at SHAs c011431 and 136edad (both MEDIUM risk). Current head 7ef5985 is a retrigger commit only — the diff is identical (same single-file deletion, 34 deletions, 0 additions). No new concerns introduced.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated review — human attention needed

This PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops.

Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the needs-human-review label and the cascade can be re-engaged on the next push.

Posted by the don-petry PR-review cascade.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud