ci: remove the superseded legacy CodeQL workflow

[JosunLP]

Deletes .github/workflows/codeql-analysis.yml. One file, nothing else.

Why

Enabling Advanced Security added codeql.yml, so the repository has been running two CodeQL setups against every commit:

	Languages	Actions
codeql-analysis.yml (legacy template)	javascript	checkout@v3, codeql-action@v2
codeql.yml (advanced setup)	javascript-typescript + actions	checkout@v7, codeql-action@v4

The new one is a strict superset — same JS/TS code, plus the workflow files themselves — and it's the only one of the two not on the deprecated Node 20 runtime. The legacy file is the sole remaining source of this warning on every run:

The following actions target Node.js 20 but are being forced to run on Node.js 24:
actions/checkout@v3, github/codeql-action/analyze@v2,
github/codeql-action/autobuild@v2, github/codeql-action/init@v2

bQuery/bQuery already carries codeql.yml alone, so this also brings the two repositories in line.

Why this is a separate pull request

It could have gone into #1, but that would have cost that PR its green status for no good reason. While a configuration exists on main and not on a branch, code scanning reports "1 configuration present on refs/heads/main was not found" and fails the aggregate CodeQL check — we hit exactly that failure mode earlier in #1's history.

Landing the deletion on main first means #1 picks it up by merging main, with no window where the two sides disagree.

Suggested order: merge this first, then #1, then bQuery/bQuery#207.

Risk

Low, and reversible by a revert. Code scanning coverage does not decrease — codeql.yml analyzes a superset of what is removed. The only observable change is one fewer duplicate analysis per commit, and the Node 20 warning disappearing.

Validation

Nothing to run: the change is a file deletion, and the remaining workflow is unmodified. CodeQL's own Analyze (javascript-typescript) and Analyze (actions) on this PR are the check that coverage still holds.

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Removed the scheduled security code analysis workflow.
  • No changes to the product experience or public functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c12801af-e909-48f3-a7c5-7f523b467904

📥 Commits

Reviewing files that changed from the base of the PR and between ba8e961 and 8338bf6.

📒 Files selected for processing (1)

• .github/workflows/codeql-analysis.yml

💤 Files with no reviewable changes (1)

• .github/workflows/codeql-analysis.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request deletes the GitHub Actions workflow that ran CodeQL analysis for JavaScript on pushes, pull requests, and a weekly schedule.

Changes

Cohort / File(s)	Summary
CodeQL workflow removal .github/workflows/codeql-analysis.yml	Deletes the CodeQL workflow and its repository permissions, triggers, language configuration, and analysis steps.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 8338b

This PR removes a duplicate legacy CodeQL workflow without reducing the stated scanning coverage or changing product runtime behavior. No actionable merge-blocking risk remains beyond normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing the superseded legacy CodeQL workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/remove-legacy-codeql-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}