graft: migrate to org-wide CodeQL configuration

[security-graft-app]

🔒 Migrate to org-wide CodeQL configuration

Hello! 👋

The sec eng team is rolling out an improved CodeQL configuration across all repositories. This provides several benefits:

• Organisation-wide custom security rules — built on findings from past VAPTs
• Suppression of noisy rules — reducing false positives in code scanning results
• Faster rollout of fixes — critical rules can be added and silenced centrally without per-repo updates

---

🚀 What's changing with this PR?

• Adds the custom CodeQL workflow in your repository

---

⚠️ Expected CI behaviour

The CodeQL action in this PR will fail initially. This is expected behaviour because custom CodeQL scanning cannot run whilst the default CodeQL scanning is still enabled on the repository.

---

ℹ️ What do I need to do as a maintainer?

1. Disable the default CodeQL code scanning configuration:
   • This is because our custom CodeQL configuration cannot run alongside the default CodeQL configuration (hence CI fails).
   • Go to Settings > Security & analysis in your repo
   • Look for “Code scanning” > “CodeQL analysis”
   • Click Disable CodeQL
2. Merge this PR

Your repository will then automatically use our shared CodeQL setup and custom rules.

If you wish to revert this change, you just need to re-enable the CodeQL in the settings page above, then remove the workflow added in this PR.

---

💬 Questions or feedback?

Reach out anytime at #security and let us know if you spot issues.

Thank you for helping keep our codebases secure and maintainable!

---

Generated by GRAFT

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
starter-kit	Error			Nov 14, 2025 5:53am