Drop advanced CodeQL; Default Setup owns scans

.github/dependabot.yml

@@ -3,13 +3,7 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule: {interval: weekly}
-    # codeql-action/init and codeql-action/analyze must run the SAME release.
-    # Ungrouped, Dependabot raises one PR per action, so each PR bumps half the
-    # pair and CodeQL fails with "Loaded a configuration file for version X, but
-    # running version Y". Grouping makes the pair move in a single commit.
     groups:
-      codeql-action:
-        patterns: ["github/codeql-action*"]
       actions:
         patterns: ["actions/*"]
   - package-ecosystem: gomod

DECISIONS.md

@@ -48,9 +48,10 @@
   manifest generated from a differently normalised tree is worse than no
   manifest, because it fails for the honest verifier and no one else.
 - Preserve 4.2.5 as the rollback release and publish 5.0.0 beside it.
-- Group `codeql-action/init` and `codeql-action/analyze` in Dependabot. They must
-  run the same release, and ungrouped updates split the pair across pull
-  requests and break every scan.
+- CodeQL is GitHub Default Setup only. Do not keep an advanced CodeQL workflow
+  or a Dependabot `codeql-action` group: Default Setup already scans, the
+  advanced workflow is `disabled_manually`, and those PRs fail the MANIFEST
+  hash gate.
 - Preserve every 4.x safety boundary unchanged: no GUI launching, no arbitrary
   shell commands, no writes to live Skyrim `Data`, external processes disabled
   by default, and third-party tools hash-pinned rather than bundled.

MANIFEST.json

@@ -15,8 +15,8 @@
     {
       "executable": false,
       "path": ".github/dependabot.yml",
-      "sha256": "c098ca332e35821423ba97c746f8d903ea5e0afc19e7fef81c6e71ece7c9c042",
-      "size": 642
+      "sha256": "33678f190f32b3eeaf981f26460afe07a2852db96356dd268b77ff4381f8f71e",
+      "size": 263
     },
     {
       "executable": false,
@@ -42,12 +42,6 @@
       "sha256": "c49e70c532755b823a4fc01b0b65d9d98598c4b710f5ac57883433c73f888aa7",
       "size": 8519
     },
-    {
-      "executable": false,
-      "path": ".github/workflows/codeql.yml",
-      "sha256": "9bb18ddea813430d8c0bc134f33ea12b9632eee23a761e0715b4a817069c171f",
-      "size": 722
-    },
     {
       "executable": false,
       "path": ".github/workflows/release.yml",
@@ -117,8 +111,8 @@
     {
       "executable": false,
       "path": "DECISIONS.md",
-      "sha256": "650f9e420377515cfd9b93e2a1ed35299fe3d41de9936cf52e105d787e04ff5a",
-      "size": 3792
+      "sha256": "59b86953ef3dc8ad7203e7ba72d78acd093d2fbc616b56c0c7ad8cca1b44b4d7",
+      "size": 3846
     },
     {
       "executable": false,
@@ -1149,8 +1143,8 @@
     {
       "executable": false,
       "path": "tests/test_ci_validation.py",
-      "sha256": "2a52432ca8a4f4ae8435e790af72d710bb07e080928ffb9263e3f655a078509d",
-      "size": 4375
+      "sha256": "82ec883308707d19074285573ec74bc175ab54294ed8c067a1394fb5843be1a1",
+      "size": 4768
     },
     {
       "executable": false,

SBOM.spdx.json

@@ -44,7 +44,7 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "c098ca332e35821423ba97c746f8d903ea5e0afc19e7fef81c6e71ece7c9c042"
+          "checksumValue": "33678f190f32b3eeaf981f26460afe07a2852db96356dd268b77ff4381f8f71e"
         }
       ],
       "copyrightText": "NOASSERTION",
@@ -114,21 +114,6 @@
         "NOASSERTION"
       ]
     },
-    {
-      "SPDXID": "SPDXRef-File-.github-workflows-codeql.yml",
-      "checksums": [
-        {
-          "algorithm": "SHA256",
-          "checksumValue": "9bb18ddea813430d8c0bc134f33ea12b9632eee23a761e0715b4a817069c171f"
-        }
-      ],
-      "copyrightText": "NOASSERTION",
-      "fileName": "./.github/workflows/codeql.yml",
-      "licenseConcluded": "NOASSERTION",
-      "licenseInfoInFiles": [
-        "NOASSERTION"
-      ]
-    },
     {
       "SPDXID": "SPDXRef-File-.github-workflows-release.yml",
       "checksums": [
@@ -299,7 +284,7 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "650f9e420377515cfd9b93e2a1ed35299fe3d41de9936cf52e105d787e04ff5a"
+          "checksumValue": "59b86953ef3dc8ad7203e7ba72d78acd093d2fbc616b56c0c7ad8cca1b44b4d7"
         }
       ],
       "copyrightText": "NOASSERTION",
@@ -2879,7 +2864,7 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "2a52432ca8a4f4ae8435e790af72d710bb07e080928ffb9263e3f655a078509d"
+          "checksumValue": "82ec883308707d19074285573ec74bc175ab54294ed8c067a1394fb5843be1a1"
         }
       ],
       "copyrightText": "NOASSERTION",

tests/test_ci_validation.py

@@ -81,8 +81,16 @@ def test_dependabot_groups_the_codeql_pair(self):
         config = self.WORKFLOWS.parent / "dependabot.yml"
         if not config.exists():
             self.skipTest("no dependabot configuration present")
-        self.assertIn("github/codeql-action", config.read_text(encoding="utf-8"),
-                      "dependabot must group codeql-action so the pair cannot be split across pull requests")
+        workflows_text = "\n".join(w.read_text(encoding="utf-8") for w in self.WORKFLOWS.glob("*.yml"))
+        if "github/codeql-action" in workflows_text:
+            self.assertIn("github/codeql-action", config.read_text(encoding="utf-8"),
+                          "dependabot must group codeql-action so the pair cannot be split across pull requests")
+            return
+        self.assertNotIn(
+            "github/codeql-action",
+            config.read_text(encoding="utf-8"),
+            "GitHub Default Setup owns CodeQL; dependabot must not track codeql-action",
+        )
 
     def test_release_publish_is_idempotent(self):
         # Forge stopped publishing releases of its own when it moved into the