ci: lean Actions per CI-CD-STANDARD §11 — drop redundant CodeQL push:main (§11e)

[ChelseaKR]

Why

CI minutes are a failure mode, not just a cost: the account-wide Actions billing block means a quota-exhausted repo stops gating merges entirely. This sweep applies CI-CD-STANDARD §11 (lean Actions). ledger is already almost fully conformant — 8/8 workflows have concurrency groups, ubuntu-only runners, toolchain caching on CI (and none in release), a scheduled-only advisory mutation workflow, and push triggers scoped to main. The single genuine gap was CodeQL's per-merge push: main run.

Per-workflow changes

Workflow	Change
codeql.yml	Dropped the push: main trigger per §11e; pull_request into main + weekly schedule remain. Header comment rewritten to explain that the weekly run analyzes refs/heads/main and keeps the canonical alert state current.
ci.yml	No change — already §11c/11f/11g/11i conformant (single-version 3.12 matrix, push:[main] + PR, cancel-in-progress, uv/pip/npm caching).
mutation.yml	No change — advisory, schedule + dispatch only (§11d).
release.yml	No change — tag-triggered, cancel-in-progress: false, caching explicitly disabled (§8b/§8c).
scorecard.yml	No change — push: main retained because publish_results: true only publishes from default-branch runs.
secret-scan-scheduled.yml, semgrep.yml, standards.yml	No change — already conformant (weekly schedule / PR+weekly / push:main-only respectively).

Skipped (with reasons)

Item

Reason

§11h docs-only paths-ignore on ci.yml

ci.yml mixes heavy jobs with security-scanner jobs (pip-audit, gitleaks, zizmor, Trivy) in one workflow, and paths-ignore is trigger-level — adding it would skip the scanners, which is forbidden (scanners scan everything). All 11 of its job names are required status checks, so a docs-skip would also need same-named twin jobs across the board. Splitting scanners into their own workflow is a non-mechanical restructure left for a deliberate follow-up.

Flag

The dropped push: main CodeQL run was deliberately documented as keeping the default-branch alert backlog current per merge. The weekly schedule run covers the same bookkeeping with up to a week of Security-tab latency; the merge gate itself (PR-triggered CodeQL analyze (python) / (actions) required checks) is untouched. If per-merge alert closure matters more than the ~2 matrix-job runs per merge, reject this PR.

Verification (all local — GitHub Actions is billing-blocked account-wide, so CI will not run here)

• actionlint on codeql.yml: clean (no pre-existing findings either).
• python3 -c 'yaml.safe_load(...)' on codeql.yml: parses.
• Conformance checker (--repo mode) before and after: 31/31 both; actions_sha_pinned (84/84), workflow_permissions (8/8), no_silenced_security_gate, security_scanners_armed all PASS before and after.
• Required checks confirmed via gh api repos/ChelseaKR/ledger/rules/branches/main: the CodeQL required contexts are PR-driven and unaffected; no job renames.
• Diff touches only .github/workflows/codeql.yml.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JEt7d9aeBFmPToT46Sciqw