[lukisch]

What

T-20261107-558181168. The CodeQL / analyze check is red on every run (push to main c381595, pull requests, the weekly schedule), not caused by any PR: "advanced configurations cannot be processed when the default setup is enabled". The repository has two CodeQL configurations:

• the GitHub default setup, read-only check via gh api repos/dev-bricks/CareCenter-for-Codex/code-scanning/default-setup: state: configured, languages actions and python, query suite default, schedule weekly, configured since 2026-07-22 (its analyses are green);
• the own workflow .github/workflows/codeql.yml (python only, added 2026-10-30), an advanced configuration, which GitHub rejects while the default setup is on.

This PR removes the workflow and keeps the default setup (the recommendation of the ticket): less maintenance, nothing is lost because the default setup already covers Python and, in addition, GitHub Actions. The contract test in tests/test_metadata.py that required the file now forbids it and any github/codeql-action step; a CHANGELOG entry explains the decision.

Not done on purpose: switching the repository to the advanced setup would be a repository setting of the owner. If that is ever wanted, change the setting first and add the workflow in the same step.

Check of other repositories (read-only)

Of the 262 local clones, 10 (8 distinct GitHub repositories) have an own CodeQL workflow. code-scanning/default-setup there: clirec, decision-clicker, ellmos-unified-gui, session-checkpoint, swarm_ai are not-configured (no double configuration); ellmos-core and ellmos-delegation-authority answer "Advanced Security must be enabled" (private, no default setup possible); odysseus is a third-party repository (no access). So CareCenter-for-Codex is the only affected repository among them. The count covers the clones of this host only, no full scan.

Tests

Red first (1e23798: test_codeql_runs_through_the_github_default_setup_only fails because the file exists), then the removal. tests/test_metadata.py, tests/test_docs_contracts.py, tests/test_security_license_contract.py: 57 passed. ruff check clean.

Separate from #10 (the TOML fix) on purpose: CI configuration against runtime code, different risk, independent revert.

🤖 Generated with Claude Code

https://claude.ai/code/session_01THB2EysTVQFXz5moenpBvW

[github-actions]

Welcome! 👋 Thanks for your first pull request in this repository.

A maintainer will review it soon. Please make sure:

• Your changes are tested
• Documentation is updated if needed
• The PR description explains what and why

Thanks for contributing!

[lukisch]

Independent review at aadf043, from a session that is not the author. Merged (squash). The code-scanning default setup is configured for python and actions (weekly, default suite; read via the API), so removing .github/workflows/codeql.yml loses no coverage and ends the failing analyze job ("advanced configurations cannot be processed when the default setup is enabled"), which failed identically on main. The new contract test test_codeql_runs_through_the_github_default_setup_only fails with the old workflow restored and passes without it. No other github/codeql-action step is left under .github/. All checks are green on this head. Independent review by Claude Opus 5.5 (claude-opus-5-5); posted with the owner's account, so this is a comment, not a formal review.