[woksin]

Removed

• The common workflow bootstrap no longer propagates .github/codeql/codeql-config.yml to repositories, and changing the shared CodeQL configuration no longer triggers an organization-wide bootstrap run. Thanks to @einari. (Stop distributing the shared CodeQL configuration #200)

[woksin]

Reviewer notes (not release notes)

• Supersedes Stop distributing the shared CodeQL configuration #200 (einari), re-applied on current main e888941; README conflict resolved.
• Deployment approval: L0 approved merging with bootstrap-package-update-safety red by design (the bootstrap script is a push-trigger path), on the condition of a hand-built dry run.
• Dry run (read-only, GET-only gh shim, sourcing the script's real functions): 33 targeted repos; 32 no-diff (no file adds/updates, no legacy deletions, no label creation); 1 not comparable: Cratis/Showrunner (created 2026-10-25 06:03Z, recursive tree truncated) — the real script also returns 1 there without writing; pre-existing condition, unrelated to this change.
• Expected bootstrap run after merge: "pushed 0 commit(s)" (last run 40148584886 pushed 0).
• [skip ci] exception (Workflows#163) kept and still documented in README.
• Local: bootstrap-schedules, rollout and policy tests OK; actionlint OK.
• The 32 repo copies of .github/codeql/codeql-config.yml are removed separately after the bootstrap run is confirmed.