ci: restore CodeQL workflow (advanced setup) gated by CLDMV_SKIP_CODE_SCANNING

.github/workflows/codeql.yml

@@ -0,0 +1,80 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/security/codeql.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/codeql.yml
+#
+# THIS REPO: jsonv-vscode is a declarative grammar extension with NO
+# CodeQL-analyzable source, so real analysis fails "no source code seen". The
+# repository variable CLDMV_SKIP_CODE_SCANNING is set (Settings → Variables →
+# Actions) so reusable-codeql.yml@v4 skips analysis and uploads an empty
+# (0-alert) CodeQL SARIF instead — a PASSING result that satisfies the
+# `code_scanning` ruleset merge gate without running CodeQL. Do NOT delete this
+# workflow to "fix" CodeQL failures: that re-opens the permanent "Waiting for
+# Code Scanning results" block. Unset the variable if the repo ever gains real
+# analyzable source.
+#
+# REQUIRED REPO SETTING — CodeQL must be in "Advanced" mode for this workflow
+# to upload SARIF. If the repo has CodeQL "Default setup" enabled (the
+# GitHub-managed alternative), upload runs fail with:
+#
+#   "Code Scanning could not process the submitted SARIF file: CodeQL
+#    analyses from advanced configurations cannot be processed when the
+#    default setup is enabled"
+#
+# The org-bootstrap-repo action automatically disables default setup
+# (overwrite-with-warn) on every fanout run, so a freshly-bootstrapped
+# repo lands in the right state by default. If you want to KEEP default
+# setup (the GitHub-managed config) instead of this workflow, DELETE
+# this codeql.yml file — with the conflict gone, the bootstrap leaves
+# default setup alone on subsequent runs.
+#
+# Manual fix when running outside the bootstrap:
+#   Settings → Code security and analysis → Code scanning → CodeQL
+#   analysis → ⚙️ → Switch to advanced.
+name: 🔍 CodeQL
+
+on:
+    push:
+        branches: [master, main]
+    # Same fork-PR consideration as ci.yml: pull_request fires for forks; SARIF
+    # upload to base-repo Security tab fails with read-only token. Acceptable —
+    # push-to-master analysis after merge catches anything missed. DO NOT use
+    # pull_request_target (runs base-repo workflow with secrets against fork
+    # code; dangerous).
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        # Include the v4 integration branches (`next`, `hotfixes`) so feature
+        # and hotfix PRs trigger CodeQL. Without these, branch protection
+        # rulesets that require the CodeQL check on `next`/`hotfixes` will
+        # sit on "waiting for results" indefinitely. Branches that don't
+        # exist in a given repo simply never trigger the workflow — harmless
+        # for repos that haven't adopted the v4 staging-branch flow.
+        branches: [master, main, next, hotfixes]
+    schedule:
+        - cron: "37 14 * * 1" # weekly Monday 14:37 UTC; GitHub updates queries over time
+
+permissions:
+    security-events: write
+    contents: read
+    actions: read
+
+concurrency:
+    group: codeql-${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }}
+
+jobs:
+    analyze:
+        uses: CLDMV/.github/.github/workflows/reusable-codeql.yml@v4
+        with:
+            languages: "javascript-typescript"
+            # Override defaults if needed:
+            # queries: "security-extended,security-and-quality"
+            # paths_ignore: "node_modules/,dist/,coverage/,**/test/**"
+            # config_file: ".github/codeql-config.yml"
+            # build_mode: "autobuild"