test(ci): re-register CodeQL workflow under fresh path codeql-security.yml

[hyperpolymath]

Second diagnostic arm (alongside #92). vexometer's codeql.yml startup_fails regardless of content state while identical content passes elsewhere — same signature that in nexia-list resolved to a wedged workflow registration (fresh path started fine). Renaming re-registers the workflow under a new path. If this PR's CodeQL (migrated) run starts while the old-name runs never did, the fix is this rename; the mystery then rests with GitHub's workflow registry rather than repo content.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7669d72f-f992-4603-a43f-b3815ede98b1

📥 Commits

Reviewing files that changed from the base of the PR and between 8dc873a and 7bca965.

📒 Files selected for processing (1)

• .github/workflows/codeql-security.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (15)

• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: scan / shell-secrets
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: scan / rust-secrets
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: lint-workflows
• GitHub Check: lint-workflows

🔇 Additional comments (1)

.github/workflows/codeql-security.yml (1)

3-3: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the CodeQL workflow’s displayed name to indicate its migrated status.

Walkthrough

The GitHub Actions workflow name changes from CodeQL to CodeQL (migrated). No workflow behaviour changes.

Changes

CodeQL workflow

Layer / File(s)	Summary
Update workflow display name .github/workflows/codeql-security.yml	The workflow name changes from CodeQL to CodeQL (migrated).

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 7bca9

The workflow’s displayed name changes, but its execution behavior is unchanged, so no merge-blocking impact is evident.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains that the CodeQL workflow path is renamed to test whether a fresh workflow registration resolves startup_fails. This directly relates to the changeset and objectives.
Title check	✅ Passed	The title clearly identifies the CodeQL workflow re-registration and names the new codeql-security.yml path. It accurately summarises the primary diagnostic change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit sees the workflow name
Changed with one small line
CodeQL now marks its migration
The checks still run on time
No paths or actions change
The burrow stays aligned}

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

Result: negative — and decisive. Renamed to a brand-new workflow path + name → still startup_failure on the PR run. Combined with #92 (grant-shape) and #90 (4.38.1→4.38.0 SHA), the full elimination table is:

suspect	status
4.38.1 tag/SHA pins	eliminated (fails on 4.38.0 SHA too — while hypatia/nexia pass on them)
workflow file content	eliminated (byte-identical passes on hypatia)
security-events grant position	eliminated (#92)
workflow path/name registration	eliminated (this PR)

⇒ The residue is repo-side state (code scanning / CodeQL registration), not controllable from repo files. Recommended owner actions: Settings → Code security and analysis → CodeQL — toggle code scanning/default setup off and on (clears wedged registrations); if Code Quality… then push any commit. If it still fails, GitHub support ticket with run ids 35721763116 (post-rollback failure) + the pre-rollback failures. Closing this diagnostic.