diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml deleted file mode 100644 index e156f73..0000000 --- a/.github/codeql/codeql-config.yml +++ /dev/null @@ -1,6 +0,0 @@ -name: "Cratis CodeQL config" - -query-filters: - # CA1031 is intentionally excluded from the shared baseline. - - exclude: - id: ca1031 diff --git a/.github/scripts/bootstrap-common-workflows.sh b/.github/scripts/bootstrap-common-workflows.sh index 1e3d53e..4dbdffa 100644 --- a/.github/scripts/bootstrap-common-workflows.sh +++ b/.github/scripts/bootstrap-common-workflows.sh @@ -8,7 +8,6 @@ # - auto-approve-publish-deployments.yml — auto-approves npm/nuget trusted publishing deployments # - verify-pull-request-policy.yml — notes, drift, release intent and work records in one job; # replaces only known bootstrapped legacy wrappers atomically -# - .github/codeql/codeql-config.yml — shared CodeQL query filters # # Called by .github/workflows/bootstrap-common-workflows.yml after checkout. # @@ -321,16 +320,6 @@ render_policy_wrapper() { printf '%s\n' "${file_content//__POLICY_RUNNER__/$runner}" } -# .github/codeql/codeql-config.yml — shared CodeQL configuration -# Decodes to: -# name: "Cratis CodeQL config" -# -# query-filters: -# # CA1031 is intentionally excluded from the shared baseline. -# - exclude: -# id: ca1031 -BOOTSTRAPPED_FILES[".github/codeql/codeql-config.yml"]="bmFtZTogIkNyYXRpcyBDb2RlUUwgY29uZmlnIgoKcXVlcnktZmlsdGVyczoKICAjIENBMTAzMSBpcyBpbnRlbnRpb25hbGx5IGV4Y2x1ZGVkIGZyb20gdGhlIHNoYXJlZCBiYXNlbGluZS4KICAtIGV4Y2x1ZGU6CiAgICAgIGlkOiBjYTEwMzEK" - # Stable POSIX checksum of the repository name: Monday, minute 1-59, 03:00-07:59 UTC. # Unlike an array index, this does not move existing schedules when repositories are added. package_update_cron() { @@ -634,9 +623,6 @@ update_repo() { file_b64=$(printf '%s\n' "$file_content" | base64 | tr -d '\n') fi case "$file_path" in - .github/codeql/codeql-config.yml) - file_label="codeql-config" - ;; *.yml) file_label=$(basename "$file_path" .yml) ;; diff --git a/.github/scripts/tests/bootstrap-package-update-safety.test.py b/.github/scripts/tests/bootstrap-package-update-safety.test.py index f7a4e82..4f60912 100644 --- a/.github/scripts/tests/bootstrap-package-update-safety.test.py +++ b/.github/scripts/tests/bootstrap-package-update-safety.test.py @@ -47,7 +47,6 @@ def test_only_package_update_implementation_trigger_is_excluded(self): self.assertEqual(event_paths(BOOTSTRAP, "push"), [ ".github/workflows/cleanup-pr-artifacts.yml", ".github/workflows/auto-approve-publish-deployments.yml", - ".github/codeql/codeql-config.yml", ".github/scripts/bootstrap-common-workflows.sh", ]) self.assertIn(' branches: ["main"]', event_block(BOOTSTRAP, "push")) diff --git a/.github/workflows/bootstrap-common-workflows.yml b/.github/workflows/bootstrap-common-workflows.yml index 6f794c9..472fc61 100644 --- a/.github/workflows/bootstrap-common-workflows.yml +++ b/.github/workflows/bootstrap-common-workflows.yml @@ -7,15 +7,14 @@ name: Bootstrap Common Workflows # • auto-approve-publish-deployments.yml — approves npm/nuget trusted publishing deployments # • verify-no-work-records.yml — fails PRs that track AI session work records # • verify-release-notes.yml — fails release-bound PRs whose description breaks the release-note contract -# • .github/codeql/codeql-config.yml — shared CodeQL query filters # # Handles both initial bootstrap (new repos) and ongoing updates: # • New repos: adds missing wrapper workflows # • Already-bootstrapped: updates wrappers if content has changed # • Already up-to-date: skips processing # -# Triggered automatically on push to main when the watched workflows, CodeQL -# config or bootstrap script change. Package-update implementation changes do +# Triggered automatically on push to main when the watched workflows or the +# bootstrap script change. Package-update implementation changes do # not change the canonical wrapper and must not trigger organization-wide writes. # Can also be run manually via workflow_dispatch. # @@ -33,7 +32,6 @@ on: paths: - ".github/workflows/cleanup-pr-artifacts.yml" - ".github/workflows/auto-approve-publish-deployments.yml" - - ".github/codeql/codeql-config.yml" - ".github/scripts/bootstrap-common-workflows.sh" workflow_dispatch: diff --git a/README.md b/README.md index 13af5d1..6684167 100644 --- a/README.md +++ b/README.md @@ -251,7 +251,7 @@ for automatic merge. existing callers already reference the reused implementation, and an implementation update must not rewrite unrelated repositories. The bootstrap workflow itself is not in those paths either, so this narrowly scoped rollout triggers no organization-wide -write workflow. All other watched workflow/template, CodeQL and bootstrap-script +write workflow. All other watched workflow/template and bootstrap-script triggers remain intact; changing those still requires separate deployment approval. Stage is explicitly excluded from bootstrap because it owns its reviewed package-update/kernel guard workflow and pin, which bootstrap must not overwrite. @@ -560,12 +560,6 @@ This workflow is included in the common workflow bootstrap process and is automa --- -## Shared CodeQL configuration - -The common workflow bootstrap also propagates **`.github/codeql/codeql-config.yml`** to repositories. The shared config currently excludes rule `ca1031`. - ---- - ## Shared cache actions Two composite actions replace hand-written `actions/cache` steps. Each gives a repository one key and one path list per ecosystem. That matters because the path list is part of the cache version: a cache saved by a step with one path list is never restored by a step with another, even under the same key. @@ -1101,7 +1095,7 @@ be cloned, no repositories, or no files to scan). A clean run prints ### `bootstrap-common-workflows.yml` **Triggers:** `push` to `main` when a watched reusable workflow (including -`cleanup-pr-artifacts.yml`), CodeQL config, or bootstrap script changes; also +`cleanup-pr-artifacts.yml`) or bootstrap script changes; also `workflow_dispatch`. Maintains common wrappers across non-archived Cratis repositories, subject to its