feat(governance): add codeql-reusable.yml — consolidate 263-repo codeql.yml drift

[hyperpolymath]

Summary

Third foundational reusable in the workflow-convergence sweep (#168 → #174 → #187 → #190 → this). Targets codeql.yml, the 263-deployment CodeQL security-analysis workflow.

Drift survey

Full pagination of gh api /search/code against org:hyperpolymath, blob-SHA grouped:

Metric	Value
Total deployments	263
Unique blob SHAs	69 (26% drift — same as mirror.yml)
Top 7 SHAs coverage	195/263 (74%)
Long-tail SHAs	62 SHAs / 68 repos

Language matrix distribution (key for design)

Languages	Repos	Share
javascript-typescript only	223	84.8%
actions only	22	8.4%
NONE (no matrix declared)	6	2.3%
rust only	3	1.1%
javascript-typescript,rust	3	1.1%
actions,javascript-typescript	3	1.1%
actions,javascript-typescript,rust	2	0.8%
actions,rust	1	0.4%

100% of estate variants use build-mode: none — verified across rust-only, actions-only, and mixed sampled variants.

Design choice — single-language single-job reusable

Caller invokes the reusable once per language. Multi-language wrappers (~3.4%) call it multiple times in parallel; per-language SARIF separation is preserved via the category: "/language:${{ inputs.language }}" step.

This matches how callers already think about CodeQL (one job per language) without forcing a JSON-array input or matrix-as-string-input. The alternative (matrix-as-input) would have made the 85% single-language case more awkward.

Inputs

• language (string, default javascript-typescript) — single CodeQL language identifier
• build-mode (string, default none) — 100% of estate currently uses none; default covers everything
• runs-on (string, default ubuntu-latest)

Caller wrapper examples

Single-language (~85% of estate):

jobs:
  codeql:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>

~5 lines, replacing ~49.

Rust-only or actions-only (~10% of estate):

jobs:
  codeql:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: rust

Multi-language (~3.4% of estate):

jobs:
  codeql-js:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
  codeql-actions:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: actions
  codeql-rust:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: rust

Rollout plan

NOT started in this PR — owner-gated.

Wave	Repos	Action
1: bulk-mechanical	~210	Single-language javascript-typescript default. One-line wrapper.
2: single non-default	~25	Override language: rust or language: actions.
3: multi-language	~9	Two or three reusable invocations per wrapper.
4: NEEDS_REVIEW	~18	NONE matrix (6) + 100-line custom workflows (~2-3). Per-repo review.

Total expected sweep: ~245 PRs (93% mechanical).

Pattern hardening

• Same workflow_call shape as refactor(governance): subsume language-policy.yml + add deno-ci-reusable (semantics-level fix for estate-template drift) #168 / feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows #174 / feat(governance): add mirror-reusable.yml — consolidate 289-repo mirror.yml drift #187 / feat(governance): add secret-scanner-reusable.yml — propagate shell-secrets to 281 repos #190 — no new infrastructure.
• Independent of all open standards PRs — lands in any order.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 117 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	10

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence