fix(ci): put CodeQL under review instead of repo settings

[catinspace-au]

This cannot merge until you disable CodeQL default setup in Settings -> Code security -> Code scanning. GitHub refuses to run the workflow while default setup owns the analysis, and that switch is repo-admin.

Default setup runs CodeQL from a checkbox with no file in the tree. It cannot be configured -- it honours neither a codeql-config.yml nor a query filter -- so the only lever over any finding is a human clicking dismiss in the Security tab, and nothing about the analysis is reviewable, diffable or version-pinned.

This is the same analysis as a committed workflow: the three languages default setup resolved here (actions, javascript-typescript, python), SHA-pinned like every other action, plus a weekly schedule so a fresh CodeQL bundle finds things in code nobody has pushed to.

The job is deliberately named Analyze (<language>), which is what default setup produced, so any ruleset requiring one of those contexts survives the swap.

v4 rather than v3 because v3 is deprecated from December 2026 and already warns on every run. Pinned to v4.37.9 / cdf488f, tagged 2026-08-26, which is past the repo's 7-day cooldown.

It does not fix #67, and I want to correct something I said earlier. I reported that advanced setup would let an agent clear that alert in a PR. That was too strong. An inline # codeql[rule-id] comment does not dismiss an alert even under advanced setup -- CodeQL records it in the SARIF suppressions[] array and GitHub does not act on it. Suppressing in source needs advanced-security/dismiss-alerts or filter-sarif on top, which is a supply-chain decision on a security-tooling repo rather than a detail. That question is parked for you; my recommendation is to dismiss the single alert by hand and not take the dependency.

Sources: https://github.com/github/codeql-action/releases and https://github.com/advanced-security/dismiss-alerts

[catinspace-au]

This cannot run, and the reason is bigger than "default setup is on".

The change is to disable CodeQL default setup for this repo. The API refuses:

gh api repos/hyperi-io/hyperi-ci/code-scanning/default-setup -X PATCH -f state=not-configured
422: Code scanning default setup cannot be modified.
     This setting is controlled by organization administrators.

hyperi-ci is ENFORCED under the org config "HyperI Public" (id 257888), and that config carries:

code_scanning_options = {"allow_advanced": false}

So advanced setup is forbidden ORG-WIDE for public repos. Turning default setup off on this repo would not be enough even if it were permitted -- the config disallows the thing this PR is.

Three routes, and all three are org-level:

• Flip allow_advanced: true on "HyperI Public". It only PERMITS advanced setup; it forces nothing and turns nothing off. Lowest consequence of the three.
• Detach hyperi-ci from the enforced config. Also drops inherited secret scanning, dependabot alerts, dependency graph and private vulnerability reporting -- a real security downgrade for one config file's reviewability.
• Close this and keep default setup, which works today and has been passing on every PR.

Recommending the third unless the CodeQL configuration genuinely needs to be under review, in which case the first.

Worth knowing before choosing: advanced setup does NOT honour inline # codeql[rule] suppressions either, so it does not solve the suppression problem that motivated part of this. Alert 54 was dismissed by hand today, which is the only route under either setup.

Left as a draft rather than closed, because the decision is not mine.

[catinspace-au]

Closing. This cannot run, and the reason is not a repo setting anyone can flip.

Re-verified today:

$ gh api repos/hyperi-io/hyperi-ci/code-security-configuration --jq '.status'
enforced
$ gh api repos/hyperi-io/hyperi-ci/code-security-configuration --jq '.configuration'
{"name":"HyperI Public","target_type":"organization",
 "code_scanning_options":{"allow_advanced":false}}

The org configuration "HyperI Public" is ENFORCED on this repo with allow_advanced: false, so an advanced CodeQL workflow is forbidden org-wide for public repos. It is not a repo toggle, and a PR adding one cannot take effect.

Three routes existed. Two need an org admin: change the org configuration, or move this repo out of it. The third is to keep default setup, which is what runs today and which found and reported the one alert we had (dismissed 2026-09-22).

Recommending the third, which is the current state, so there is nothing to merge. Reopen if the org configuration changes.