ci: CodeQL language matrix -> actions

[hyperpolymath]

Problem

.github/workflows/codeql.yml declared the CodeQL language javascript-typescript, but this repo contains no JS/TS source. As a result the analyze (javascript-typescript) job failed "no source files found" on every run, producing zero SAST signal.

Fix

Set the CodeQL language matrix to exactly actions. CodeQL's actions language scans the GitHub Actions workflow files (which this repo has), giving real, actionable SAST coverage. Per the repo's own Hypatia workflow_audit recommendation.

Change

• Matrix include entry: language: javascript-typescript -> language: actions.
• The rest of the workflow is untouched; category: "/language:${{ matrix.language }}" is preserved (it parameterises on matrix.language).
• Only .github/workflows/codeql.yml is modified.

https://claude.ai/code/session_017TXizM5c1Yd9HWf7Y15YH2

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 39 issues detected

Severity	Count
🔴 Critical	4
🟠 High	10
🟡 Medium	25

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "scorecard_wrapper_missing_job_permissions",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/krl/krl/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "line": 24,
    "reason": "Secret found: Generic API key",
    "type": "secret_detected",
    "file": "/home/runner/work/krl/krl/.envrc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "reason": "Nominal-only SAST in krl: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/krl/krl",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "1 workflow(s) with tag-pinned (not SHA-pinned) actions in krl",
    "type": "DependencyPinning",
    "file": "/home/runner/work/krl/krl",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
    "scorecard_check": "Pinned-Dependencies"
  },
  {
    "reason": "Repository has 3 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 2 day(s) old",
    "type": "CSA001",
    "file": "spec/grammar-overview.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 2 day(s) old",
    "type": "CSA001",
    "file": "docs/practice/AI-CONVENTIONS.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence