[Elodie Mirza (elodiejmirza)]

BLUF

• Restores one authoritative CodeQL configuration by removing two conflicting checked-in advanced workflows and retaining the verified GitHub default setup.
• Hardens the remaining multi-platform CI workflow so manual flags are data rather than shell syntax, credentials are not persisted, token authority is read-only, test failures fail closed, and workflow-only changes are tested.
• Keeps this pull request in draft until the complete current-head matrix and security checks pass.

Closes SoloSentryOrg/github-enterprise-management-solosentry#110

Changes

• Deleted the duplicate C/C++ and Python advanced CodeQL workflows.
• Retained live default CodeQL coverage for Actions, C/C++, and Python with the extended query suite.
• Added workflow-level contents: read and persist-credentials: false.
• Moved manual cmake_flags input into an environment variable and quoted Bash arrays; removed the input from build and test commands where it was not a CMake configure flag.
• Removed continue-on-error from CTest and stopped excluding .github/** changes from CI.
• Updated actions/checkout to the live-resolved full SHA for v5; retained the existing pinned upload-artifact v4 SHA.
• Documented the organization-managed CodeQL authority and live-reconciliation control in AGENTS.md.

Verification

• git diff --check: passed.
• actionlint .github/workflows/ci.yml: passed with no findings.
• zizmor .github/workflows/ci.yml: passed with no findings; two repository suppressions remain unchanged.
• Gitleaks scoped directory scan: passed with no leaks.
• GitHub tag readback: actions/checkout v5 resolves to fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09; upload-artifact v4 resolves to the retained ea165f8d65b6e75b540449e92b4886f43607fa02.
• Live CodeQL default-setup readback: configured for actions, c-cpp, and python, extended suite, weekly cadence.
• Default CodeQL analysis run 33251632316: passed before workflow deletion.

Security Review Evidence

• Reviewed scope: .github/workflows/ci.yml, both deleted CodeQL workflows, and the CodeQL operating control in AGENTS.md.
• Final committed-range Codex Security scan 2c0458d6-c15b-471d-9273-5ef50167595e: complete four-path coverage through signed head 0d539d0616134d50b826cf05f8ff99c5298036c7, zero reportable findings.
• Fixed findings: raw untrusted workflow input in shell; absent explicit token permissions; checkout credential persistence; masked test failures; workflow-only CI bypass; stale checkout action.
• CodeQL configuration conflict is removed without reducing verified language or query-suite coverage.
• Fix-forward evidence: initial remote runs 33385708819 and 33385750167 correctly failed Windows configure because a quoted generator string was split. Signed follow-up 0d539d0616134d50b826cf05f8ff99c5298036c7 now constructs -G and MinGW Makefiles as a two-element array; final-head remote validation passed: runs 33386042234 and 33386045316 completed successfully across Windows, macOS, Ubuntu latest Debug, and Ubuntu 22.04.
• Residual risk: remote multi-platform CI passed on the exact head; post-merge default-setup and workflow-run readback remains required; master currently has no effective repository ruleset or classic branch protection and is tracked separately in SoloSentryOrg/github-enterprise-management-solosentry#112 for owner-approved, deadlock-safe implementation.

Lessons Learned

• Applicable: LL-0002, LL-0003, LL-0004, LL-0007, LL-0010, LL-0011.
• Complexity removed or justified: two duplicate CodeQL implementations are removed; the existing CI is hardened in place instead of adding another workflow.

Rollback

• Revert this commit only if live default setup becomes unavailable; do not restore an advanced workflow until live settings, exact check names, language coverage, and ruleset dependencies are reconciled.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T11:36:47.403505Z	0d539d0	Draft marked ready
🔒 Security Review	✅ Completed 2026-08-31T11:39:33.080629Z	0d539d0	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Pull request overview

This PR reconciles CodeQL configuration by removing conflicting checked-in advanced workflows in favor of the organization-managed GitHub default setup, and hardens the primary CI workflow to reduce risk from untrusted inputs and overly-permissive defaults.

Changes:

• Removed two advanced CodeQL workflow files to eliminate conflicting configurations and rely on the verified GitHub default CodeQL setup.
• Hardened .github/workflows/ci.yml: removed .github/** path ignores, added contents: read permissions, disabled checkout credential persistence, and ensured tests fail the job.
• Refactored manual CMake flags handling so workflow-dispatch inputs are consumed as data and only applied at configure time (not build/test).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
AGENTS.md	Documents the intended “default CodeQL setup only” operating control and reconciliation guidance.
.github/workflows/codeql-analysis.yml	Deleted duplicate advanced CodeQL workflow (C/C++).
.github/workflows/codeql-analysis-python.yml	Deleted duplicate advanced CodeQL workflow (Python).
.github/workflows/ci.yml	Hardens CI permissions/checkout behavior, removes workflow-only bypass, and tightens configure/build/test command handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.