From 01885ea4a474b3597a7ba2f12ee89eb7815e7e90 Mon Sep 17 00:00:00 2001
From: Pat Riehecky <riehecky@fnal.gov>
Date: Wed, 20 May 2026 14:08:46 -0500
Subject: [PATCH] Tighten workflows

---
 .github/workflows/ci.yaml     |  3 +++
 .github/workflows/codeql.yaml | 48 -----------------------------------
 2 files changed, 3 insertions(+), 48 deletions(-)
 delete mode 100644 .github/workflows/codeql.yaml

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c7c57ff..90c143c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,4 +1,7 @@
 name: Build and Test
+permissions:
+  contents: read
+  pull-requests: read
 
 on:
   push:
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
deleted file mode 100644
index fd33b1e..0000000
--- a/.github/workflows/codeql.yaml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '0 0 * * 1'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      contents: read
-
-    steps:
-    - name: Install build dependencies
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y cmake gcc lcov asciidoctor
-
-    - name: Checkout repository
-      uses: actions/checkout@v6
-      with:
-        fetch-depth: 0
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: c-cpp
-        queries: security-and-quality
-        config-file: .codeql-config.yml
-
-    - name: Configure
-      run: |
-        cmake -B build -S . -Wdev -Wdeprecated \
-          -DCMAKE_BUILD_TYPE=RelWithDebInfo
-
-    - name: Build
-      run: cmake --build build --parallel
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: "/language:c-cpp"