Unable to disable orphaned CodeQL default-setup workflow

[Justin140672]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Actions Runner

Discussion Details

CodeQL default setup continues to launch dynamically generated workflows on pushes even though code scanning is no longer enabled for this private repository.

There is no CodeQL workflow file in .github/workflows; Semgrep is configured separately in .github/workflows/semgrep.yml.

The CodeQL runs fail with:

“Code scanning is not enabled for this repository.”

I tried Actions → CodeQL → Workflow options → Disable workflow, but GitHub displayed:

“There was an error disabling this workflow.”

The repository’s Advanced Security settings no longer show a Code Security or CodeQL configuration section, so I cannot disable default setup there either.

Please remove or set CodeQL default setup to “not configured” for this repository without disabling or changing the separate Semgrep workflow.

[potomyznaesh]

The error message is the key. Per GitHub's docs, when Code Security is turned off for a private repository, code scanning is disabled and any code scanning workflows, SARIF uploads or API calls fail — and if Code Security is enabled again, code scanning returns to its previous state. So your default setup was never actually switched off: it's still stored as "configured", which is why the dynamic CodeQL workflow keeps firing on pushes, while the CodeQL section has disappeared from Settings → Advanced Security (it only shows when Code Security is enabled).

1. Check the stored state:

   gh api repos/OWNER/REPO/code-scanning/default-setup

2. Try switching it off directly:

   gh api -X PATCH repos/OWNER/REPO/code-scanning/default-setup -f state=not-configured

3. If step 2 returns 403 (documented as "GitHub Advanced Security is not enabled for this repository"), have an admin temporarily turn Code Security back on for this repo in Settings → Advanced Security, run the PATCH from step 2, confirm it reports not-configured, then turn Code Security off again.

None of this touches .github/workflows/semgrep.yml — that's a normal workflow file and is unrelated to default setup.

If turning Code Security on isn't possible for the repo (the docs note the control is disabled when the organization has no available licenses), then step 3 isn't available and you'll need GitHub Support to clear the leftover configuration — include the output of step 1 in the ticket.

Docs: Update a code scanning default setup configuration · Managing security and analysis settings for your repository

[Justin140672]

The issue now appears to have stopped. Two subsequent pushes have run CI and Semgrep without starting a CodeQL workflow. The final unwanted CodeQL run was #115 at 20:39 BST on 14 October 2026.

No further action is required from my side unless you believe the stored default-setup configuration still needs clearing.