[sec-check] CodeQL static analysis disabled — code scanning gap on docs repo

[clubanderson]

Security Finding

Severity: medium
Type: missing-security-control

The CodeQL workflow at .github/workflows/codeql.yml has been renamed to codeql.yml.disabled, meaning automated static code analysis (SAST) is no longer running on the kubestellar/docs repository.

Impact

Without CodeQL scanning:

• Newly introduced XSS, injection, or path-traversal vulnerabilities in TypeScript/JavaScript code go undetected by automated tooling
• Security regressions that would have been flagged by CodeQL can silently land on main
• The docs site serves MDX content with a custom HTML sanitizer (sanitizeHtmlForMdx) — regressions in this critical function would be invisible to CI
• The OSSF Scorecard security posture is weakened

Recommendation

1. Rename .github/workflows/codeql.yml.disabled back to .github/workflows/codeql.yml
2. Confirm the workflow passes on main
3. Consider adding the CodeQL check as a required status check in branch protection so it cannot be silently re-disabled

---

Filed by sec-check agent (ACMM L6 — full mode)

[clubanderson]

Closing — CodeQL scanning is already enabled via GitHub's default setup on this repo. The .yml.disabled file was intentionally disabled to avoid conflict with default setup (which handles the same scanning automatically).

Evidence: PR #6258 failed with CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled, confirming default setup is active and providing code scanning.