Use the enforced CodeQL default setup

[JordanNanos]

Purpose

The organization enforces CodeQL default setup. The checked-in advanced workflow fails because the organization blocks advanced setup.

What changed

• Remove the advanced CodeQL workflow.
• Keep the enforced CodeQL default setup active.

Effect

• Users: None.
• Operators: CodeQL checks use the organization configuration.
• Developers: Pull requests no longer run the conflicting advanced workflow.
• Data and compatibility: None.

Technical terms

• CodeQL: A GitHub service that scans source code for security problems.
• default setup: The CodeQL configuration that the organization manages.
• advanced setup: A CodeQL configuration that uses a repository workflow file.

Validation

• gh api repos/SemiAnalysisAI/ClusterMAX/code-security-configuration: Pass. The enforced configuration enables default setup and blocks advanced setup.
• gh api repos/SemiAnalysisAI/ClusterMAX/code-scanning/default-setup: Pass. The default setup state is configured.
• git diff --check: Pass.
• Not run: Runtime tests do not apply to removal of the conflicting workflow.

Merge plan

• Merge order: Merge this PR before PR Bump actions/upload-artifact from 4.6.2 to 7.0.1 #1, PR Bump setuptools from 80.9.0 to 84.0.0 #2, PR Bump build from 1.3.0 to 1.5.0 in /.github/requirements #3, PR Bump setuptools from 80.9.0 to 84.0.0 in /.github/requirements #4, PR Bump twine from 6.2.0 to 7.0.0 in /.github/requirements #5, and PR Bump wheel from 0.45.1 to 0.48.0 in /.github/requirements #6.
• Dependency: The enforced organization security configuration.
• Release step: Re-run the dependency pull request checks after this PR merges.

Design decisions for approval

• Approval required: No.
• Decision: Use the enforced CodeQL default setup.
• Options: Use default setup or advanced setup.
• Recommendation: Use default setup because the organization configuration requires it.
• Approver: None.

Risk and recovery

• Risk: The repository workflow no longer selects CodeQL languages.
• Safeguard: The organization configuration detects and scans supported languages.
• Rollback: Permit advanced setup in the organization configuration and restore the workflow.

Excluded work

• Changes to the organization security configuration.
• Dependency updates in PR Bump actions/upload-artifact from 4.6.2 to 7.0.1 #1 through PR Bump wheel from 0.45.1 to 0.48.0 in /.github/requirements #6.

---

Note

Low Risk
Deletes a conflicting CI workflow only; scanning shifts to org-managed CodeQL default setup with no application or data-path changes.

Overview
Removes the repository’s custom .github/workflows/codeql.yml workflow so CodeQL no longer runs via the advanced (workflow-file) setup.

That workflow previously detected languages on the branch (Actions, C/C++, JS/TS, Python) and ran github/codeql-action analyze jobs on push/PR to master and release/**, plus a weekly schedule. After this change, security scanning is expected to come only from the organization’s enforced CodeQL default setup, which was blocking the advanced workflow.

^{Reviewed by Cursor Bugbot for commit ad98db4. Bugbot is set up for automated code reviews on this repo. Configure here.}