From a826320b7cfb02aac24b0574f285bf757d6b9358 Mon Sep 17 00:00:00 2001 From: Gintaras Kazlauskas Date: Sun, 16 Aug 2026 23:44:14 +0300 Subject: [PATCH] docs(ci): correct header on parked codeql.yml.disabled The parked CodeQL workflow still carried the inherited 'ENABLED' header; document why it is inert (no GHAS license on the team plan) and how to re-enable. --- .github/workflows/codeql.yml.disabled | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml.disabled b/.github/workflows/codeql.yml.disabled index d3f3a36..a0c04e9 100644 --- a/.github/workflows/codeql.yml.disabled +++ b/.github/workflows/codeql.yml.disabled @@ -1,4 +1,8 @@ -# codeql.yml — inherited baseline, ENABLED for this repository. +# codeql.yml.DISABLED — CodeQL requires GitHub Advanced Security, which the +# org (team plan) does not license; code scanning on PRIVATE repos is +# unavailable (HTTP 403 on default-setup). Fleet pattern: keep the workflow +# intact but inert until GHAS is procured — re-enable by removing the +# .disabled suffix (audit finding: security tooling procurement). # jol-m-data carries Python gate scripts and pipeline code — CodeQL # analyzes them on every PR. Pin actions to full SHAs before first merge # to main (fleet supply-chain discipline).