From a61a05c025a04d73e220d3ed6a39e32073f46183 Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Wed, 13 May 2026 07:00:46 -0500
Subject: [PATCH] =?UTF-8?q?ci(actions):=20remove=20custom=20CodeQL=20workf?=
 =?UTF-8?q?low=20=E2=80=94=20default=20setup=20now=20enabled?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Default code-scanning setup was enabled via the API once the repo flipped
public (PR-merge sequence on 2026-05-13 at f6637ec3). With default setup
configured for Swift + JS/TS + actions + python languages, our custom
codeql.yml workflow can no longer upload SARIF (GitHub rejects with
"default setup is enabled" error). Removing the redundant workflow.

Default setup gives:
  - CodeQL for Swift, JavaScript, TypeScript, GitHub Actions, Python
  - "Default" query suite (less aggressive than security-extended; can
    be tightened later via the API or repo Settings)
  - Auto-scheduled scans on push/PR
  - Zero workflow YAML to maintain

Loses (vs custom workflow):
  - security-extended query suite. Re-enable via:
      gh api -X PATCH /repos/KofTwentyTwo/Jarvis/code-scanning/default-setup \\
        -f query_suite=security-extended
  - Manual Swift build path. Default setup auto-detects builds.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 61 ------------------------------------
 1 file changed, 61 deletions(-)
 delete mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index e549f93..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-# CodeQL static analysis for Swift + JavaScript/TypeScript.
-
-name: CodeQL
-
-on:
-  push:
-    branches: [develop, main, "rc/*", "release/*"]
-  pull_request:
-    branches: [develop, main]
-  schedule:
-    - cron: "0 9 * * 1"
-
-concurrency:
-  group: codeql-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  analyze:
-    name: Analyze ${{ matrix.language }}
-    runs-on: ${{ matrix.language == 'swift' && 'macos-15' || 'ubuntu-latest' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: javascript-typescript
-            build-mode: none
-          - language: swift
-            build-mode: manual
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Select Xcode (swift)
-        if: matrix.language == 'swift'
-        run: sudo xcode-select -s /Applications/Xcode_16.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-          queries: security-extended
-
-      # CodeQL needs a manual Swift build. We build a representative subset
-      # of packages (Bus, AgentCore, MCP) so the security lane stays cheap;
-      # extending to all 14 packages would dominate the CI budget.
-      - name: Build Swift (CodeQL extraction)
-        if: matrix.language == 'swift'
-        run: |
-          swift build --package-path packages/Bus
-          swift build --package-path packages/AgentCore
-          swift build --package-path packages/MCP
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{ matrix.language }}"
-- 
2.54.0