From d5742aab900e83baa49bf2a2a3dcda1d96d3911b Mon Sep 17 00:00:00 2001
From: Martin Vogel <martin.vogel@datadice.io>
Date: Sat, 9 May 2026 16:52:11 +0200
Subject: [PATCH] ci(codeql): revert CodeQL gate hardening from 27e640b

Reverts the CodeQL portion of 27e640b ('fix(mcp,ci): harden
get_architecture serialization + CodeQL gate'). Leaves the mcp.c +
test_mcp.c changes (NULL-coercion, clusters/services serialization,
extract_text_content fix, regression test) intact.

Restored to the pre-27e640b state:
  - drop 'jq' from build-deps install line
  - drop 'queries: +./codeql' from codeql-action/init (no ./codeql
    custom-query directory exists in this repo)
  - drop 'id: analyze' and 'output: codeql-results' on analyze step
  - drop the SARIF-parsing 'Fail on CodeQL error-level findings' step

CI workflow changes need their own design discussion per CONTRIBUTING.md
('Project configuration / CI workflows' is in the explicit-approval list);
the gate hardening landed bundled with an unrelated bug fix. Splitting it
out so the upstream MCP fix stays clean and any future CodeQL gate work
can be its own focused PR.
---
 .github/workflows/codeql.yml | 24 +-----------------------
 1 file changed, 1 insertion(+), 23 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 68738b524..ce5b2d18a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,40 +15,18 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install build dependencies
-        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev jq
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
         with:
           languages: c-cpp
           build-mode: manual
-          queries: +./codeql
 
       - name: Build for CodeQL analysis
         run: scripts/build.sh
 
       - name: Perform CodeQL Analysis
-        id: analyze
         uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
         with:
           category: "/language:c-cpp"
-          output: codeql-results
-
-      - name: Fail on CodeQL error-level findings
-        run: |
-          sarif=$(find codeql-results -name '*.sarif' | head -1)
-          if [[ -z "$sarif" ]]; then
-            echo "::error::No SARIF output found"; exit 1
-          fi
-          err=$(jq '[.runs[].results[]? | select((.level // "warning") == "error")] | length' "$sarif")
-          warn=$(jq '[.runs[].results[]? | select((.level // "warning") == "warning")] | length' "$sarif")
-          echo "CodeQL findings: $err error(s), $warn warning(s)"
-          if [[ "$err" -gt 0 ]]; then
-            jq -r '
-              .runs[].results[]?
-              | select((.level // "warning") == "error")
-              | "\(.locations[0].physicalLocation.artifactLocation.uri):\(.locations[0].physicalLocation.region.startLine) [\(.ruleId)] \(.message.text)"
-            ' "$sarif"
-            echo "::error::$err CodeQL error-level finding(s) — failing build."
-            exit 1
-          fi