ci: remove drift codeql.yml, enable GitHub-managed default setup

[don-petry]

Summary

• Enabled GitHub-managed CodeQL default setup via API (state=configured, query_suite=default)
• Removed the per-repo .github/workflows/codeql.yml — per org CI standards §2, this file is drift: the advanced setup added no behavior beyond what default setup provides automatically
• Leaving the workflow file behind after enabling default setup would cause both to run and double-bill CI minutes

Why

The weekly compliance audit (codeql-default-setup-not-configured) flagged that the repo's CodeQL default setup was not in the configured state. The org standard (§2) explicitly requires GitHub-managed default setup and treats per-repo codeql.yml files as drift to be removed.

Test plan

• gh api -X PATCH repos/petry-projects/ContentTwin/code-scanning/default-setup returned success (run_id: 24189973602)
• Verify in repo Settings → Code security → Code scanning that default setup shows as "Configured"
• Confirm next compliance audit closes this finding

Closes #65

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 8 minutes and 11 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9839987e-3cda-4428-b888-ceeade934ec9

📥 Commits

Reviewing files that changed from the base of the PR and between 4625df4 and 23d1c1b.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-65-20260414-1410

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Removes the repository’s custom CodeQL GitHub Actions workflow to align with org policy requiring GitHub-managed CodeQL default setup and to avoid duplicate scans (and CI minutes) when default setup is configured out-of-band.

Changes:

• Deleted .github/workflows/codeql.yml to eliminate “advanced setup” drift
• Relies on GitHub-managed CodeQL default setup being configured via API (per PR description)

Comments suppressed due to low confidence (2)

.github/workflows/codeql.yml:1

• Deleting the workflow removes the explicit trigger configuration (push/PR limited to main + a weekly cron) and the explicit language: [\"actions\"] scope. Before merging, make sure GitHub-managed default setup is configured to provide equivalent coverage (languages + scan frequency), otherwise this change can reduce scanning cadence or change what gets analyzed compared to the previous workflow.
  .github/workflows/codeql.yml:1
• The PR description states CodeQL default setup was enabled via API, but the diff only removes the workflow file. Since that configuration isn’t reviewable/auditable in-repo, consider adding a lightweight, repo-local breadcrumb (e.g., a short entry in SECURITY.md / docs noting that CodeQL is managed via default setup and when/where it was configured) so future reviewers can more easily validate the intended state without relying on PR text.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

All CI checks are green. @don-petry — please review and merge when ready.

[don-petry]

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: 2c507f6011c7e7eaa92eca4e873bb0f47324c8dc
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Note: GitHub does not permit a PR author to approve their own PR. This verdict is posted as a comment; a human reviewer should approve when ready.

Summary

PR removes the per-repo codeql.yml in favour of GitHub-managed CodeQL default setup, per org standard §2. All CI checks pass, including a separate (managed) CodeQL check that confirms default setup is active. The compliance issue that triggered this work was itself a false positive caused by 403 errors in the audit tool, not a real misconfiguration; the PR is still valid because it correctly consolidates to the managed setup and eliminates the duplicate-scan cost.

Findings

Minor

• [minor] (auditability) The API call that enabled GitHub-managed default setup (run_id: 24189973602) is not traceable from the repo. Test-plan verification checkboxes for "Verify Settings → Code scanning shows Configured" and "Confirm compliance audit closes Compliance: codeql-default-setup-not-configured #65" remain unchecked. Consider adding a note to SECURITY.md or similar so future reviewers can validate the intended state without relying on PR text.
• [minor] (compliance-false-positive) Issue Compliance: codeql-default-setup-not-configured #65 was created by the compliance audit receiving 403 errors from the CodeQL default-setup API (not an actual "not configured" state). The root finding was a permission issue in the audit tool, not genuine drift. This PR correctly addresses the org standard regardless, but the compliance tooling may need its token permissions reviewed.

Info

• [info] .github/workflows/codeql.yml (ci-coverage) The deleted workflow explicitly scanned language actions (GitHub Actions YAML files). The statusCheckRollup shows a standalone "CodeQL" check succeeding alongside the workflow-based check, confirming GitHub-managed default setup is already running and covers this PR. After merge, verify in repo Settings that actions is listed under detected languages for default setup.
• [info] .github/workflows/codeql.yml:14 (scan-schedule) The deleted workflow included a weekly cron schedule (Monday 05:30 UTC) to catch vulnerabilities introduced without a push. GitHub-managed default setup also runs on schedule by default — worth confirming the schedule is active in Settings after merge.

CI status

All CI checks green. mergeStateStatus: BLOCKED (branch protection rules pending; auto-merge queued below).

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[donpetry-bot]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud