From 07071e6f32f1e108be6ef3a08a06e60239b00cff Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Fri, 24 Jul 2026 22:56:54 -0700
Subject: [PATCH] Use shared-config's reusable CodeQL workflow

Replaces the full copy-pasted codeql.yml with a thin caller of
rubyatscale/shared-config/.github/workflows/codeql.yml@main
(rubyatscale/shared-config#29), passing this repo's language list
(["actions","javascript"]) as input instead of a hardcoded matrix. Functionally
identical - same checkout/codeql-action SHAs, same build-mode: none,
same permissions - but future fixes (like the stale version-comment
cleanup in shared-config#28) now land once in shared-config instead of
needing to be repeated by hand across every repo.
---
 .github/workflows/codeql.yml | 29 +++--------------------------
 1 file changed, 3 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 495adb2..fbb31af 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -12,33 +12,10 @@ on:
 
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - language: actions
-            build-mode: none
-          - language: javascript
-            build-mode: none
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.37.3
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.37.3
-        with:
-          category: "/language:${{ matrix.language }}"
+    uses: rubyatscale/shared-config/.github/workflows/codeql.yml@main # zizmor: ignore[unpinned-uses] internal reusable workflow tracked at @main by convention so shared-config updates propagate automatically
+    with:
+      languages: '["actions","javascript"]'