ci: add codeql.yml for compliance

[don-petry]

Summary

• Adds .github/workflows/codeql.yml to satisfy the compliance requirement for a required codeql.yml workflow
• The new file has identical content to the existing codeql-analysis.yml
• Closes Compliance: missing-codeql.yml #103

Notes

The existing codeql-analysis.yml is retained. If desired, it can be removed in a follow-up to avoid running CodeQL twice on each trigger event. However, adding codeql.yml is the minimal change required to resolve the compliance finding.

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 7 minutes and 17 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 7 minutes and 17 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 50f01db5-6508-4063-b8be-90acf4984803

📥 Commits

Reviewing files that changed from the base of the PR and between 1620841 and 5f5e5b5.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-103-20260407-1732

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review

The change is minimal and correct:

• .github/workflows/codeql.yml added with identical content to codeql-analysis.yml
• Satisfies the compliance check for missing-codeql.yml
• Pinned action hashes and least-privilege permissions are already in place

One follow-up to consider: Both codeql.yml and codeql-analysis.yml will now trigger CodeQL on the same events, resulting in duplicate runs. It would be cleaner to delete codeql-analysis.yml in a follow-up PR once this compliance fix merges.

@don-petry — you're the code owner for this repo. This is a one-line compliance fix (adding a required workflow file). Please review and merge when ready.

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow file to meet the organization’s compliance requirement that a required .github/workflows/codeql.yml exists, aligning this repo’s CI setup with the referenced standards.

Changes:

• Add .github/workflows/codeql.yml for CodeQL scanning (mirrors existing codeql-analysis.yml).

[Copilot]

This workflow has the same triggers and contents as the existing .github/workflows/codeql-analysis.yml, so adding it will cause CodeQL to run twice on each push/PR/scheduled run. If compliance only requires the presence of codeql.yml, consider disabling triggers in one of the workflows (e.g., workflow_dispatch only) or removing the duplicate workflow to avoid doubled CI time and compute usage.

Suggested change

	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: '25 14 * * 1'
	workflow_dispatch:

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Closing as stale — predates the standards PR.

This PR was generated by Claude during the original bulk-toggle yesterday, before petry-projects/.github#86 landed. That standards PR added prompt rules that:

• Require copying from petry-projects/.github/standards/workflows/ verbatim instead of writing workflow files from scratch
• Require verifying SHAs via gh api instead of guessing
• Require the CodeQL actions ecosystem in the matrix where applicable
• Allow gh api and gh label create for admin operations

Re-toggling the underlying issue will let Claude regenerate this fix using the new rules. The next run should produce a workflow that is byte-identical to the standard template (verified with the canary on TalkTerm#51 → PR #78 yesterday).