[mytrashcan]

Summary

Resolves the "Actions workflow not enabled / manually set to inactive" state and CodeQL deprecation warnings.

Root cause: When CodeQL default setup was enabled, GitHub disabled the existing CI workflow because it contained manual CodeQL steps (init + analyze) — duplicate scanning. The manual steps also used codeql-action@v3, which is deprecated (December 2026), and build-mode: manual conflicted with default setup.

Fix: Removed the manual CodeQL init and analyze steps from ci.yml. CodeQL scanning is now exclusively handled by default setup (automatically maintained, v4).

Also addresses in the run log:

• Cannot build an overlay-base database because build-mode is set to "manual" — gone (no manual init step)
• CodeQL Action v3 will be deprecated in December 2026 — gone (default setup uses v4)
• Node 20 deprecation warnings on checkout/setup-java remain — informational only, actions still run on Node 24; will resolve when action majors bump

Verification

• YAML validated locally ✅
• CI workflow remains contents: read + security-events: write scoped (dependency-review needs the write scope; trivy uploads nothing)

[mytrashcan]

Self-review (repo workflow — cannot APPROVE own PR).

Scope: removes the manual CodeQL init/analyze steps from ci.yml (9 deletions). CodeQL scanning is now exclusively handled by default setup (dynamic/github-code-scanning/codeql, active).

Why correct:

• Default setup was enabled 2026-08-02, which auto-disabled the CI workflow because it contained manual CodeQL steps (duplicate scanning). Removing them lets CI stay active.
• Removes the build-mode: manual overlay-base warning and the codeql-action@v3 deprecation (default setup is auto-maintained on v4).
• Remaining permissions are correct: contents: read + security-events: write (dependency-review-action needs write).

Verification: YAML parses locally ✅; workflow re-enabled and shows active ✅; CodeQL default setup also active ✅.

No blocking findings.

Reviewed by Hermes Agent - deepseek-v4-flash

[mytrashcan]

PR #14 Review — ci: remove manual CodeQL steps (default setup handles scanning)

Verified OK

• CodeQL default setup is configured for this repo (state: configured, languages: actions/java-kotlin, weekly schedule) and is already producing analyses for refs/pull/14/head — removing the manual init/analyze steps correctly eliminates the duplicate-scanning conflict that disabled the CI workflow, and drops the build-mode: manual overlay-base error.
• Removing codeql-action@v3 (SHA 02c5e834...) clears the December 2026 deprecation warning; default setup maintains v4 automatically.
• No other workflow files exist and no leftover CodeQL references remain after the change — nothing dangling. Job permissions (contents: read, security-events: write) are unchanged.

Nit / Optional

• ci.yml:22 — after removing the CodeQL steps, security-events: write on the verify job may no longer be strictly needed: dependency-review-action posts PR comments (requires pull-requests: write, and degrades gracefully without it) and trivy uploads nothing. Keeping it is harmless (job-scoped token), but the PR description's claim that "dependency-review needs the write scope" slightly overstates the need — security-events: write is the scope CodeQL uploads use, which default setup now owns.

Good Things

• Root cause was verified before changing config: the workflow-disable state came from duplicate scanning, and this removes the duplication at the source instead of blindly re-enabling the workflow.
• Minimal, focused diff (9 deletions) with a clear verification section.

Summary

No blocking or should-fix issues. The fix is correct — manual CodeQL v3 steps were redundant with default setup and caused the disabled-workflow state. Safe to merge.

Reviewed by Hermes Agent - deepseek-v4-flash