ci: remove drift codeql.yml and enable GitHub-managed default setup

[don-petry]

Summary

• Enabled GitHub-managed CodeQL default setup via API (state=configured, query_suite=default)
• Deleted .github/workflows/codeql.yml — per org standard ci-standards.md §2, per-repo CodeQL workflow files are drift; the two configurations are mutually exclusive and leaving the file causes double-billing of CI minutes

Why

The compliance audit (codeql-default-setup-not-configured) flags repos whose GitHub-managed default setup is not in configured state. The org standard explicitly requires GitHub-managed default setup and treats per-repo codeql.yml files as drift to be removed.

Closes #92

---

Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 57 minutes and 32 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: cda833af-ecd1-4e8d-9023-5264e30527f9

📥 Commits

Reviewing files that changed from the base of the PR and between d8da2d2 and a733d74.

📒 Files selected for processing (1)

• .gitignore

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-92-20260414-1257

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry CI is green — please review and merge when ready.

[Copilot]

Pull request overview

Removes the repository-local CodeQL GitHub Actions workflow to avoid drift and rely on GitHub-managed CodeQL “default setup” configuration, aligning the repo with the org compliance standard referenced in #92.

Changes:

• Deleted .github/workflows/codeql.yml to prevent dual CodeQL configurations and duplicate CI usage.

Comments suppressed due to low confidence (1)

.github/workflows/codeql.yml:1

• Deleting this workflow removes the Analyze (actions) check run that the repo’s code-quality required-status-checks ruleset is currently configured to require (see .github/scripts/apply-code-quality-ruleset.sh, which derives that context name from this workflow). If that ruleset/branch protection is active, merges to the default branch will become blocked because the required check will never appear.

Please update the required check context(s) to match whatever check name GitHub-managed CodeQL default setup produces (or remove CodeQL from required checks if policy allows) before merging this change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Automated review — NEEDS HUMAN REVIEW

Risk: HIGH
Reviewed commit: 02d8b9ebb41e58f6346cb98ac98e95f26a0d9c34
Cascade: triage → audit (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

Confirmed live against the GitHub API: ruleset 14805963 (code-quality) currently requires the status check 'Analyze (actions)', which is produced exclusively by the codeql.yml workflow this PR deletes. The GitHub-managed default setup produces a differently named check ('CodeQL', no workflowName). Merging as-is will orphan a required status check — future PRs will be blocked indefinitely waiting for a check that no workflow produces. The PR must update the code-quality ruleset (and/or apply-code-quality-ruleset.sh) to reference the new check name in the same change. Agreeing with deep review: HIGH risk, escalate.

Findings

Critical

• [critical] .github/workflows/codeql.yml — Verified via gh api repos/petry-projects/markets/rulesets/14805963: the active code-quality ruleset requires status checks SonarCloud and Analyze (actions) with strict_required_status_checks_policy=true. The check Analyze (actions) is produced only by .github/workflows/codeql.yml, which this PR deletes. After merge, that check run will no longer be created on PRs against main, so every subsequent PR will be permanently blocked by the required check. Must update the ruleset (replace Analyze (actions) with the managed-setup name CodeQL) atomically with this deletion, or update .github/scripts/apply-code-quality-ruleset.sh and re-apply, before or as part of merging.

Major

• [major] .github/workflows/codeql.yml — A CI security-scanner workflow is being removed. The statusCheckRollup on this PR confirms the GitHub-managed CodeQL check is currently firing alongside Analyze (actions) and is SUCCESS, so scanning coverage is not lost as long as the managed setup remains enabled. However, the managed setup was enabled out-of-band via API and is not recorded in any tracked file, so there is no guardrail against silent reversion.
• [major] (repo-wide) — The PR/commit body claims state=configured, query_suite=default was applied via API, but no infrastructure-as-code artifact in this diff reflects that API call. If the managed setup is later disabled or downgraded (e.g., by another admin, a token rotation, or an accidental API call), no CI will detect the regression — the deleted workflow was the only tripwire. Recommend recording the default-setup state in a tracked config (e.g., apply-repo-settings.sh) or a compliance-audit test before merging.

Minor

• [minor] .github/scripts/apply-code-quality-ruleset.sh — Still hard-codes {context: "Analyze (actions)"}. Even if the live rulelet is updated manually, the next re-apply of this script would re-introduce the stale required-check name. Update the script in the same PR (or a follow-up that lands before this merges) to reference CodeQL.

Info

• [info] .github/workflows/codeql.yml:27 — The deleted workflow used SHA-pinned actions (actions/checkout@de0fac… and github/codeql-action@5c8a8a…). The GitHub-managed default setup hides action references entirely — this is consistent with org standard ci-standards.md §2 and is an acceptable trade-off, noted for transparency.
• [info] (scope) — No application code, dependencies, secrets handling, authN/authZ, input validation, crypto, or data-exposure surfaces are touched. Scope is purely CI configuration. SonarCloud Quality Gate passed with 0 new issues. AgentShield passed. Author is MEMBER (don-petry) working on a bot-generated branch (claude/issue-92-…) tied to compliance issue #92.

CI status

mergeStateStatus: BLOCKED — the PR is currently blocked from merging.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: d52b4fe0fec0114ab64744d7fa95488471ae8d37
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

The prior review's critical finding (orphaned required status check 'Analyze (actions)') has been resolved: ruleset 14805963 was updated 2026-04-17 and now requires 'CodeQL' (GitHub-managed) instead. All CI checks are green, issue #92 is closed, and the substantive change (deleting the drift codeql.yml) is correct and aligned with org standards. Two major maintenance hazards remain — the stale apply-code-quality-ruleset.sh script and absent IaC tracking for the managed setup — but neither blocks this merge. Approving with findings for follow-up.

Findings

• INFO: The critical issue from the prior tier-2/3 review (Apr 16) has been resolved: ruleset 14805963 was updated 2026-04-17 and now requires 'CodeQL' (managed setup) and 'SonarCloud', not 'Analyze (actions)'. The 'CodeQL' check is currently producing SUCCESS results on this PR. Merging this PR will not orphan any required status check.
• MAJOR: apply-code-quality-ruleset.sh still hardcodes '{context: "Analyze (actions)"}' in the required_status_checks payload. Re-running this script (e.g., as a routine re-apply or after an incident) would reset the live ruleset back to requiring 'Analyze (actions)', which no workflow produces after this PR merges — re-introducing the exact blocking condition that blocked this PR. The script also still includes 'claude-code / claude', which is not in the current live ruleset. This script should be updated to reference 'CodeQL' before or shortly after this PR merges.
• MAJOR: GitHub-managed CodeQL default setup was enabled via direct API call (state=configured, query_suite=default), as described in the PR body. This state is not reflected in any tracked IaC file — no apply-repo-settings.sh entry, no compliance test. If an admin disables the managed setup, or if repo settings are reset, CodeQL scanning will silently disappear with no CI guardrail. Recommend adding 'gh api -X PATCH repos/petry-projects/markets/code-scanning/default-setup ...' to apply-repo-settings.sh or an equivalent tracked script.
• INFO: All required status checks pass: 'CodeQL' (GitHub-managed, workflowName empty) = SUCCESS, 'SonarCloud' = SUCCESS (0 new issues, quality gate passed), 'CodeRabbit' = SUCCESS. The 'Analyze (actions)' check is also SUCCESS on this PR because the branch still contains codeql.yml — it will no longer be produced on future PRs after this merges, which is correct behavior since the ruleset no longer requires it.
• INFO: Issue #92 (codeql-default-setup-not-configured compliance finding) was closed 2026-05-12, confirming the managed setup is active. mergeStateStatus is BLOCKED due to REVIEW_REQUIRED (org-leads team review pending), not CI failures.
• INFO: Change scope is a single file deletion (.github/workflows/codeql.yml, 36 lines). No application code, secrets, auth, crypto, DB schema, or sensitive configuration is touched. Author is MEMBER (don-petry); branch is bot-generated (claude/issue-92-*). SonarCloud quality gate passed with 0 new issues.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 125a7437695ab603d173ee3ae222250c1998f93d
Review mode: triage-approved (single reviewer)

Summary

Triage tier cleared this PR as low-risk and that assessment holds up on confirmation. Scope is a single-file deletion of .github/workflows/codeql.yml (36 lines) to align with org standard ci-standards.md §2, which mandates GitHub-managed CodeQL default setup over per-repo workflows. The managed setup is currently active and producing the CodeQL check (SUCCESS). The earlier blocker raised by tier-2/3 audit on commit 02d8b9e — orphaned required status check Analyze (actions) — was resolved 2026-04-17 when ruleset 14805963 was updated to require CodeQL (managed) and SonarCloud. Full cascade audit already approved the prior SHA d52b4fe; the only changes since are merge commits from main touching unrelated files (apply-code-quality-ruleset.sh, claude.yml, dev-lead.yml).

Linked issue analysis

Closes #92 (codeql-default-setup-not-configured compliance finding). Issue was closed 2026-05-12 confirming the managed setup is in state=configured with query_suite=default. The substantive ask of #92 — getting the GitHub-managed default setup into configured state — is fully addressed. The drift removal in this PR is the complementary cleanup required by org standard.

Findings

• INFO: Scope is exclusively CI configuration: one workflow file deleted, zero application/dependency/secret/auth/crypto/schema surfaces touched. Author is MEMBER (don-petry) on a bot-generated compliance branch.
• INFO: All required status checks are green on the head SHA — Analyze (actions) SUCCESS (still produced because the workflow file exists at the head until merge), CodeQL (managed setup, no workflowName) SUCCESS, SonarCloud SUCCESS (Quality Gate passed, 0 new issues), CodeRabbit SUCCESS. After merge, Analyze (actions) will stop being produced, which is correct since the ruleset no longer requires it.
• MAJOR (non-blocking, carry-forward): .github/scripts/apply-code-quality-ruleset.sh still hardcodes {context: "Analyze (actions)"} in the required_status_checks payload. Re-running the script (routine re-apply, post-incident reset) would revert the live ruleset to require a check that no workflow produces after this merges — recreating the exact block this PR's prior audit cycle flagged. Recommend a follow-up PR replacing "Analyze (actions)" with "CodeQL" in that script. Same finding as the previously approved review; not introduced by this PR.
• MAJOR (non-blocking, carry-forward): GitHub-managed CodeQL default setup is currently enabled by an out-of-band API call described in the PR body but not recorded in any tracked IaC artifact. If a future admin action disables the managed setup, scanning will silently disappear with no CI guardrail. Recommend recording the default-setup state in apply-repo-settings.sh or an equivalent tracked compliance check. Same finding as previously approved review; not introduced by this PR.
• INFO (delta since prior review): Diff between d52b4fe and 125a7437 is purely merge commits from main affecting .github/scripts/apply-code-quality-ruleset.sh, .github/workflows/claude.yml, and .github/workflows/dev-lead.yml. None of those are this PR's intended changes; PR's own diff remains the single codeql.yml deletion.

CI status

mergeStateStatus: BLOCKED due to outstanding review approval requirements (org-leads team review), not CI. mergeable: MERGEABLE. All status checks SUCCESS.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

Superseded by automated re-review at 125a743.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Automated review — human attention needed

This PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops.

Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the needs-human-review label and the cascade can be re-engaged on the next push.

Posted by the donpetry-bot PR-review cascade.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.