fix(ci): switch CodeQL language matrix to actions

[hyperpolymath]

Summary

• Hypatia flagged HCG's codeql.yml as nominal-only SAST: the language matrix listed javascript-typescript, but the repo has no source files in any CodeQL-scannable language. Every analyze run exited with "no source files" and recorded zero results.
• Switch the matrix to actions — CodeQL's GitHub Actions analyser scans workflow files, which every repo has.

Closes

• Hypatia alert External validation: gateway is 1:1 prior art for proposed GitHub wiki-API anti-abuse design #25 — hypatia/workflow_audit/codeql_language_matrix_mismatch
• Hypatia alert ci: repin orphan reusable SHAs (97df7621/4fdf4314 → live) #28 — hypatia/scorecard/StaticAnalysis (nominal-only SAST)

Test plan

• Local diff inspection: 1-line matrix change, no other edits
• CI: analyze (actions, none) runs green on this PR
• Post-merge: Hypatia alerts External validation: gateway is 1:1 prior art for proposed GitHub wiki-API anti-abuse design #25 + ci: repin orphan reusable SHAs (97df7621/4fdf4314 → live) #28 auto-close on next scan
• No regression: other workflows (Hypatia, governance, dogfood-gate) stay green

Refs standards#91 Phase D (HCG repo hygiene as part of the benchmark scaffold).

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

🔍 Hypatia Security Scan

Findings: 14 issues detected

Severity	Count
🔴 Critical	6
🟠 High	3
🟡 Medium	5

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Nickel file missing SPDX-License-Identifier header (1 occurrences, CWE-1104)",
    "type": "ncl_missing_spdx",
    "file": "/home/runner/work/http-capability-gateway/http-capability-gateway/configs/config.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (1 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/http-capability-gateway/http-capability-gateway/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Nominal-only SAST in http-capability-gateway: codeql.yml language matrix contains no language present in the repo and lacks `actions`, so CodeQL records zero results on every commit. Remediation: set the CodeQL matrix to `language: actions`.",
    "type": "StaticAnalysis",
    "file": "/home/runner/work/http-capability-gateway/http-capability-gateway",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Add CodeQL or equivalent SAST workflow.",
    "scorecard_check": "SAST"
  },
  {
    "reason": "Repository has 2 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "6a2ml file outside canonical location -- must be in .machine_readable/6a2/",
    "type": "SD004",
    "file": ".machine_readable/STATE.a2ml",
    "action": "move",
    "rule_module": "structural_drift",
    "severity": "critical"
  },
  {
    "reason": "6a2ml file outside canonical location -- must be in .machine_readable/6a2/",
    "type": "SD004",
    "file": ".machine_readable/META.a2ml",
    "action": "move",
    "rule_module": "structural_drift",
    "severity": "critical"
  },
  {
    "reason": "6a2ml file outside canonical location -- must be in .machine_readable/6a2/",
    "type": "SD004",
    "file": ".machine_readable/ECOSYSTEM.a2ml",
    "action": "move",
    "rule_module": "structural_drift",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence