using multi gitter

[Sanjana-Kondalwade]

What type of PR is this? (check all applicable)

• Refactor
• Feature
• Bug Fix
• Optimization
• Content Update

Category

• zopen build framework
• zopen package manager
• Documentation
• CI/CD
• Tools

Description

Adds a workflow to roll out CodeQL security scanning to port repos using multi-gitter.

Changes:

• .github/workflows/rollout_codeql.yml — trial run targeting 12 priority repos (gitport, makeport, curlport, gpgport, pinentryport, perlport, lessport, ncursesport, rpmport, dnf5port, vimport, autoconfport). Uses --org="" to suppress org-wide rollout until verified.
• bulk-utils/rollout_codeql.sh — script executed by multi-gitter inside each cloned repo; copies data/codeql-workflow.yml and skips if already up to date. Fixed template path resolution: now uses CODEQL_TEMPLATE env var (absolute path injected by the workflow) with a fallback for local/manual runs.

How it works:

1. multi-gitter clones each target repo, runs rollout_codeql.sh at its root
2. The script copies .github/workflows/codeql.yml from the meta repo template
3. multi-gitter commits the change and opens a PR titled "Add CodeQL security scanning workflow" in each repo

Pre-requisite before triggering:

• BUMP_TOKEN secret must have the workflow scope — without it GitHub rejects pushes to .github/workflows/ files

Related Issues

• Related Issue #
• Closes #

[optional] Are there any post-deployment tasks or follow-up actions required?

• Trigger the workflow via workflow_dispatch after merge
• Verify 12 PRs are opened, one per repo
• Once confirmed, remove --org="" and the 12 --repo flags to roll out to all port repos'
  --base main
  --head sk/rollout-codeql 2>&1