Stop distributing the shared CodeQL configuration

.github/scripts/bootstrap-common-workflows.sh

@@ -8,7 +8,6 @@
 #   - auto-approve-publish-deployments.yml — auto-approves npm/nuget trusted publishing deployments
 #   - verify-pull-request-policy.yml      — notes, drift, release intent and work records in one job;
 #                                           replaces only known bootstrapped legacy wrappers atomically
-#   - .github/codeql/codeql-config.yml     — shared CodeQL query filters
 #
 # Called by .github/workflows/bootstrap-common-workflows.yml after checkout.
 #
@@ -321,16 +320,6 @@ render_policy_wrapper() {
   printf '%s\n' "${file_content//__POLICY_RUNNER__/$runner}"
 }
 
-# .github/codeql/codeql-config.yml — shared CodeQL configuration
-# Decodes to:
-#   name: "Cratis CodeQL config"
-#
-#   query-filters:
-#     # CA1031 is intentionally excluded from the shared baseline.
-#     - exclude:
-#         id: ca1031
-BOOTSTRAPPED_FILES[".github/codeql/codeql-config.yml"]="bmFtZTogIkNyYXRpcyBDb2RlUUwgY29uZmlnIgoKcXVlcnktZmlsdGVyczoKICAjIENBMTAzMSBpcyBpbnRlbnRpb25hbGx5IGV4Y2x1ZGVkIGZyb20gdGhlIHNoYXJlZCBiYXNlbGluZS4KICAtIGV4Y2x1ZGU6CiAgICAgIGlkOiBjYTEwMzEK"
-
 # Stable POSIX checksum of the repository name: Monday, minute 1-59, 03:00-07:59 UTC.
 # Unlike an array index, this does not move existing schedules when repositories are added.
 package_update_cron() {
@@ -675,9 +664,6 @@ update_repo() {
       file_b64=$(printf '%s\n' "$file_content" | base64 | tr -d '\n')
     fi
     case "$file_path" in
-      .github/codeql/codeql-config.yml)
-        file_label="codeql-config"
-        ;;
       *.yml)
         file_label=$(basename "$file_path" .yml)
         ;;

.github/scripts/tests/bootstrap-package-update-safety.test.py

@@ -47,7 +47,6 @@ def test_only_package_update_implementation_trigger_is_excluded(self):
         self.assertEqual(event_paths(BOOTSTRAP, "push"), [
             ".github/workflows/cleanup-pr-artifacts.yml",
             ".github/workflows/auto-approve-publish-deployments.yml",
-            ".github/codeql/codeql-config.yml",
             ".github/scripts/bootstrap-common-workflows.sh",
         ])
         self.assertIn('    branches: ["main"]', event_block(BOOTSTRAP, "push"))

.github/workflows/bootstrap-common-workflows.yml

@@ -7,15 +7,14 @@ name: Bootstrap Common Workflows
 #   • auto-approve-publish-deployments.yml — approves npm/nuget trusted publishing deployments
 #   • verify-no-work-records.yml           — fails PRs that track AI session work records
 #   • verify-release-notes.yml             — fails release-bound PRs whose description breaks the release-note contract
-#   • .github/codeql/codeql-config.yml     — shared CodeQL query filters
 #
 # Handles both initial bootstrap (new repos) and ongoing updates:
 #   • New repos:            adds missing wrapper workflows
 #   • Already-bootstrapped: updates wrappers if content has changed
 #   • Already up-to-date:   skips processing
 #
-# Triggered automatically on push to main when the watched workflows, CodeQL
-# config or bootstrap script change. Package-update implementation changes do
+# Triggered automatically on push to main when the watched workflows or the
+# bootstrap script change. Package-update implementation changes do
 # not change the canonical wrapper and must not trigger organization-wide writes.
 # Can also be run manually via workflow_dispatch.
 #
@@ -33,7 +32,6 @@ on:
     paths:
       - ".github/workflows/cleanup-pr-artifacts.yml"
       - ".github/workflows/auto-approve-publish-deployments.yml"
-      - ".github/codeql/codeql-config.yml"
       - ".github/scripts/bootstrap-common-workflows.sh"
   workflow_dispatch:
 

README.md

@@ -307,7 +307,7 @@ for automatic merge.
 existing callers already reference the reused implementation, and an implementation
 update must not rewrite unrelated repositories. The bootstrap workflow itself is not
 in those paths either, so this narrowly scoped rollout triggers no organization-wide
-write workflow. All other watched workflow/template, CodeQL and bootstrap-script
+write workflow. All other watched workflow/template and bootstrap-script
 triggers remain intact; changing those still requires separate deployment approval.
 Stage is explicitly excluded from bootstrap because it owns its reviewed
 package-update/kernel guard workflow and pin, which bootstrap must not overwrite.
@@ -662,12 +662,6 @@ GitHub cron is best effort and can skip or lag. [`check-batched-releases.yml`](#
 
 ---
 
-## Shared CodeQL configuration
-
-The common workflow bootstrap also propagates **`.github/codeql/codeql-config.yml`** to repositories. The shared config currently excludes rule `ca1031`.
-
----
-
 ## Shared cache actions
 
 Two composite actions replace hand-written `actions/cache` steps. Each gives a repository one key and one path list per ecosystem. That matters because the path list is part of the cache version: a cache saved by a step with one path list is never restored by a step with another, even under the same key.
@@ -1260,7 +1254,7 @@ be cloned, no repositories, or no files to scan). A clean run prints
 ### `bootstrap-common-workflows.yml`
 
 **Triggers:** `push` to `main` when a watched reusable workflow (including
-`cleanup-pr-artifacts.yml`), CodeQL config, or bootstrap script changes; also
+`cleanup-pr-artifacts.yml`) or bootstrap script changes; also
 `workflow_dispatch`.
 
 Maintains common wrappers across non-archived Cratis repositories, subject to its