feat(governance): add codeql-reusable.yml — consolidate 263-repo codeql.yml drift

[hyperpolymath]

Summary

Third foundational reusable in the workflow-convergence sweep (#168 → #174 → #187 → #190 → this). Targets codeql.yml, the 263-deployment CodeQL security-analysis workflow.

Drift survey

Full pagination of gh api /search/code against org:hyperpolymath, blob-SHA grouped:

Metric	Value
Total deployments	263
Unique blob SHAs	69 (26% drift — same as mirror.yml)
Top 7 SHAs coverage	195/263 (74%)
Long-tail SHAs	62 SHAs / 68 repos

Language matrix distribution (key for design)

Languages	Repos	Share
javascript-typescript only	223	84.8%
actions only	22	8.4%
NONE (no matrix declared)	6	2.3%
rust only	3	1.1%
javascript-typescript,rust	3	1.1%
actions,javascript-typescript	3	1.1%
actions,javascript-typescript,rust	2	0.8%
actions,rust	1	0.4%

100% of estate variants use build-mode: none — verified across rust-only, actions-only, and mixed sampled variants.

Design choice — single-language single-job reusable

Caller invokes the reusable once per language. Multi-language wrappers (~3.4%) call it multiple times in parallel; per-language SARIF separation is preserved via the category: "/language:${{ inputs.language }}" step.

This matches how callers already think about CodeQL (one job per language) without forcing a JSON-array input or matrix-as-string-input. The alternative (matrix-as-input) would have made the 85% single-language case more awkward.

Inputs

• language (string, default javascript-typescript) — single CodeQL language identifier
• build-mode (string, default none) — 100% of estate currently uses none; default covers everything
• runs-on (string, default ubuntu-latest)

Caller wrapper examples

Single-language (~85% of estate):

jobs:
  codeql:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>

~5 lines, replacing ~49.

Rust-only or actions-only (~10% of estate):

jobs:
  codeql:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: rust

Multi-language (~3.4% of estate):

jobs:
  codeql-js:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
  codeql-actions:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: actions
  codeql-rust:
    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha>
    with:
      language: rust

Rollout plan

NOT started in this PR — owner-gated.

Wave	Repos	Action
1: bulk-mechanical	~210	Single-language javascript-typescript default. One-line wrapper.
2: single non-default	~25	Override language: rust or language: actions.
3: multi-language	~9	Two or three reusable invocations per wrapper.
4: NEEDS_REVIEW	~18	NONE matrix (6) + 100-line custom workflows (~2-3). Per-repo review.

Total expected sweep: ~245 PRs (93% mechanical).

Pattern hardening

• Same workflow_call shape as refactor(governance): subsume language-policy.yml + add deno-ci-reusable (semantics-level fix for estate-template drift) #168 / feat(governance): add rust-ci-reusable + elixir-ci-reusable workflows #174 / feat(governance): add mirror-reusable.yml — consolidate 289-repo mirror.yml drift #187 / feat(governance): add secret-scanner-reusable.yml — propagate shell-secrets to 281 repos #190 — no new infrastructure.
• Independent of all open standards PRs — lands in any order.

🤖 Generated with Claude Code