ci(codeql): replace default setup with an advanced workflow so required checks report

[mbeacom]

Problem

Two symptoms, one root cause.

1. Required checks never report. The main ruleset requires the status checks Analyze (actions) and Analyze (javascript-typescript). Those check runs came from CodeQL default setup, which GitHub documents as running on pull requests against the default branch "excluding pull requests from forks." When default setup doesn't run, the check runs are never created, and a required check that is never reported sits at Expected — Waiting for status to be reported forever. There is no way to clear it, so the PR is permanently blocked.

Observed on the current corpus — neither head SHA has a CodeQL workflow run of any kind:

PR	Author	CodeQL run on head SHA
#97	fork (aballiet)	none
#99	Dependabot	none
#98	same-repo branch	ran

2. 2 configurations not found. The same fault seen from the other side. main has a baseline analysis for /language:actions and /language:javascript-typescript; the PR has neither, so code scanning cannot diff them and reports that it "cannot determine the alerts introduced by this pull request."

Requiring the CodeQL results check instead would not have helped — on the fork PR that check is absent too. Default setup fundamentally cannot back a required check on a repository that takes fork PRs.

Fix

Replace default setup with advanced setup: a committed .github/workflows/codeql.yml. Because it is an ordinary pull_request workflow it runs for forks and for Dependabot, and code scanning permits SARIF upload from pull_request-triggered runs even under a read-only token.

Two details are load-bearing:

• The job name renders exactly Analyze (actions) and Analyze (javascript-typescript), so the existing ruleset contexts keep resolving. No ruleset edit is required. Renaming the job or a matrix language silently reintroduces the permanently-pending check.
• category stays /language:<language>, matching the category keys the default-setup baseline used, so PR-vs-base alert comparison survives the switch.

Both languages are interpreted, so build-mode: none. Actions are SHA-pinned with a trailing version comment to match ci.yml and to stay in Dependabot's github-actions group. A weekly cron preserves the baseline cadence default setup had.

Repository setting changed

Default setup and advanced setup are mutually exclusive — default setup "disables any existing CodeQL workflows, and blocks any CodeQL analysis API uploads." It has been set to not-configured via PATCH /repos/mbeacom/adrkit/code-scanning/default-setup.

⚠️ Re-enabling default setup will disable this workflow and block its uploads.

Verification

Rung 1 of the ADR-0014 ladder is this PR itself: the two required checks must move off Expected and report a real conclusion. That is the behavior that was broken, observed directly.

Note that until this lands on main, the results check may still warn about stale default-setup configurations, which have a different analysis_key (dynamic/github-code-scanning/codeql:analyze) than this workflow's. That clears once main has a baseline from this workflow; any leftover stale configurations get deleted afterwards.

[Copilot]

Pull request overview

Replaces CodeQL default setup with an advanced workflow so required security checks run for fork and Dependabot PRs.

Changes:

• Adds pull request, main-branch push, and weekly CodeQL scans.
• Preserves required check names and baseline categories.
• Uses least-privilege permissions and SHA-pinned actions.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.