fix(ci): add language: actions to codeql.yml matrix (WF020)

[hyperpolymath]

What

Adds language: actions (build-mode: none) to hypatia's codeql.yml matrix, so CodeQL scans workflow YAML for CI/CD-specific weaknesses. Clears hypatia's own workflow_audit codeql_missing_actions_language (WF020) finding — the same fix landed in empty-linter#22.

Why this is a per-repo patch, not the real fix

WF020 recurs estate-wide — dozens of codeql.yml copies across the standards monorepo's sub-repos are missing language: actions. That is the fix_locus: upstream case from the reflexivity advisory (#475): the canonical fix is once, in the shared .git-private-farm codeql template, then propagated. I can't reach .git-private-farm from this session's scope, so this is the in-repo fix for hypatia (a CI/CD-critical, reflexive subject — done here only because you explicitly authorized the cleanup).

I deliberately did not bulk-edit the ~30 codeql.yml copies in the standards monorepo: several live in protected carve-out repos (palimpsest-license, consent-aware-http) and self-language repos (a2ml, k9-svc), which the advisory says must not be swept.

Validation

• Matrix now lists javascript-typescript + actions.
• Matches the regex WF020 checks for (language:\s*actions), and the exact pattern verified-green in empty-linter#22 (the analyze (actions, none) job).

https://claude.ai/code/session_01EqEysvTPzPwhS9ZGY7EYdr

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 48 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	48

View findings

[
  {
    "reason": "Action actions/add-to-project@v1.0.2 needs attention",
    "type": "unpinned_action",
    "file": "add-to-roadmap.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in add-to-roadmap.yml",
    "type": "missing_timeout_minutes",
    "file": "add-to-roadmap.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "1 workflow(s) with tag-pinned (not SHA-pinned) actions in hypatia",
    "type": "DependencyPinning",
    "file": "/home/runner/work/hypatia/hypatia",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
    "scorecard_check": "Pinned-Dependencies"
  },
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 0 day(s) old",
    "type": "CSA001",
    "file": "add-to-roadmap.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/unpinned_action -- Hypatia workflow_audit: unpinned_action -- 0 day(s) old",
    "type": "CSA001",
    "file": "add-to-roadmap.yml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "ffi/zig/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence