From a041e8637e9d62f137dba8bf02c39a3d142c253a Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Fri, 24 Jul 2026 22:52:11 -0700
Subject: [PATCH] Make codeql.yml a reusable workflow_call workflow

Every consumer repo currently carries its own full copy of this file,
differing only in the language matrix (ruby-only, js/ts-only, rust-only,
or some mix, plus "actions" everywhere). That means fixes like the
stale-version-comment cleanup in #28 have to be repeated by hand across
~20 repos instead of landing once here, same as ci.yml/cd.yml/stale.yml/
triage.yml already solved for their own workflows.

Converts codeql.yml to workflow_call, taking the language list as a
JSON-array input (e.g. '["actions","ruby"]') instead of a hardcoded
matrix. build-mode is now unconditionally "none" for every language,
since that's what every current caller already used (GA since CodeQL
2.23.3, including for Rust/C++).

Since codeql.yml no longer has its own push/pull_request/schedule
triggers, shared-config would otherwise stop scanning its own
.github/workflows/ - added codeql-self-scan.yml to carry those triggers
and call the reusable workflow locally (`uses: ./.github/workflows/
codeql.yml`, not @main, so a PR that edits codeql.yml is tested against
its own in-PR version rather than whatever's already on main).

Verified with zizmor (offline + --gh-token) and actionlint: 0 findings
on both new/changed files.
---
 .github/workflows/codeql-self-scan.yml | 21 +++++++++++++++++++++
 .github/workflows/codeql.yml           | 20 ++++++++------------
 2 files changed, 29 insertions(+), 12 deletions(-)
 create mode 100644 .github/workflows/codeql-self-scan.yml

diff --git a/.github/workflows/codeql-self-scan.yml b/.github/workflows/codeql-self-scan.yml
new file mode 100644
index 0000000..03dc5d2
--- /dev/null
+++ b/.github/workflows/codeql-self-scan.yml
@@ -0,0 +1,21 @@
+name: "CodeQL (self-scan)"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '30 1 * * 0'
+
+jobs:
+  analyze:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/codeql.yml
+    with:
+      languages: '["actions"]'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 68e9b7f..165d621 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,14 +1,12 @@
 name: "CodeQL"
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: '30 1 * * 0'
+  workflow_call:
+    inputs:
+      languages:
+        description: 'JSON array of CodeQL languages to analyze, e.g. ["actions","ruby"]'
+        required: true
+        type: string
 
 jobs:
   analyze:
@@ -22,9 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - language: actions
-            build-mode: none
+        language: ${{ fromJSON(inputs.languages) }}
 
     steps:
       - name: Checkout repository
@@ -36,7 +32,7 @@ jobs:
         uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
+          build-mode: none
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3