docs: leave CodeQL out of the templates

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- Templates: no `codeql` job. Public repositories in the organization get CodeQL through default setup, which rejects results from `codeql.yml`.
+
 ## v1.1.3
 
 - `templates/workflows/`: caller templates for new repositories (Status checks for Go and Node, Delivery, Image rescan, Terraform, releases and more), linted by Self CI. They replace the workflow templates for the org `.github` repository, which public repositories could not use while that repository is private.

README.md

@@ -14,7 +14,7 @@ Reusable GitHub Actions workflows for the [privacybydesign](https://github.com/p
 | `node-checks.yml` | npm, Yarn or pnpm install, then lint, test and build |
 | `npm-publish.yml` | Publishes to npm with Trusted Publishing |
 | `terraform.yml` | fmt, validate, tflint, Checkov, plan and apply |
-| `codeql.yml` | CodeQL for Go, JavaScript/TypeScript and workflow files |
+| `codeql.yml` | CodeQL for Go, JavaScript/TypeScript and workflow files, for repositories without CodeQL default setup |
 | `dependency-review.yml` | Blocks pull requests that add vulnerable or disallowed-licence dependencies |
 | `workflow-lint.yml` | actionlint and zizmor |
 | `pr-title.yml` | Checks that pull request titles follow Conventional Commits |
@@ -48,6 +48,8 @@ The inputs of each workflow are documented in its file, under `on.workflow_call.
 
 On private repositories, artifact attestations are skipped, and `codeql.yml` and `dependency-review.yml` need GitHub Code Security.
 
+In the privacybydesign organization, public repositories get CodeQL through GitHub's default setup (security configuration "GitHub recommended"), so the templates leave out the `codeql` job: with default setup enabled, GitHub rejects results from a separate CodeQL workflow.
+
 ## Versioning
 
 Releases are semver tags (`v1.2.0`) with a moving major tag (`v1`), so a release reaches every caller without a change in each repository; breaking changes get a new major. Only maintainers can move `v1`, and changes are tried from a canary repository first. Third-party actions in these workflows are pinned to commit SHAs and kept up to date by Dependabot. See [CHANGELOG.md](CHANGELOG.md).

templates/workflows/status-checks-go.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
   merge_group:
   schedule:
-    - cron: "17 6 * * 1" # Mondays: CodeQL with fresh queries
+    - cron: "17 6 * * 1" # Mondays: govulncheck and image scan against fresh databases
   workflow_dispatch:
 
 permissions: {}
@@ -35,15 +35,6 @@ jobs:
     with:
       push-image: false
 
-  codeql:
-    uses: privacybydesign/github-workflows/.github/workflows/codeql.yml@v1
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-    with:
-      languages: '["go", "actions"]'
-
   dependency-review:
     uses: privacybydesign/github-workflows/.github/workflows/dependency-review.yml@v1
     permissions:
@@ -60,7 +51,7 @@ jobs:
   passed:
     name: Status checks passed
     if: always()
-    needs: [go, docker, codeql, dependency-review, workflow-lint]
+    needs: [go, docker, dependency-review, workflow-lint]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions: {}

templates/workflows/status-checks-node.yml

@@ -7,7 +7,7 @@ on:
   pull_request:
   merge_group:
   schedule:
-    - cron: "17 6 * * 1" # Mondays: CodeQL with fresh queries
+    - cron: "17 6 * * 1" # Mondays: govulncheck and image scan against fresh databases
   workflow_dispatch:
 
 permissions: {}
@@ -36,15 +36,6 @@ jobs:
     with:
       push-image: false
 
-  codeql:
-    uses: privacybydesign/github-workflows/.github/workflows/codeql.yml@v1
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-    with:
-      languages: '["javascript-typescript", "actions"]'
-
   dependency-review:
     uses: privacybydesign/github-workflows/.github/workflows/dependency-review.yml@v1
     permissions:
@@ -61,7 +52,7 @@ jobs:
   passed:
     name: Status checks passed
     if: always()
-    needs: [node, docker, codeql, dependency-review, workflow-lint]
+    needs: [node, docker, dependency-review, workflow-lint]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions: {}

templates/workflows/terraform.yml

@@ -32,13 +32,6 @@ jobs:
     secrets:
       TF_ENV: ${{ secrets.TF_ENV }}
 
-  codeql:
-    uses: privacybydesign/github-workflows/.github/workflows/codeql.yml@v1
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-
   dependency-review:
     uses: privacybydesign/github-workflows/.github/workflows/dependency-review.yml@v1
     permissions:
@@ -55,7 +48,7 @@ jobs:
   passed:
     name: Status checks passed
     if: always()
-    needs: [terraform, codeql, dependency-review, workflow-lint]
+    needs: [terraform, dependency-review, workflow-lint]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions: {}