ci: disable CodeQL

.changeset/disable-codeql.md

@@ -0,0 +1,9 @@
+---
+"nostream": patch
+---
+
+ci: disable CodeQL workflow
+
+Removes the CodeQL Advanced GitHub Actions workflow, custom query pack, config,
+and route suppression comments to stop false-positive security alerts on admin
+routes that already use custom auth and rate limiting.

src/routes/admin/index.ts

@@ -24,9 +24,9 @@ import { withAdminController } from '../../handlers/request-handlers/with-admin-
 
 const router: Router = Router()
 
-// codeql[js/missing-rate-limiting] - custom Redis-backed sliding window rate limiter
+// Custom Redis-backed sliding window rate limiter
 router.use(rateLimiterMiddleware)
-// codeql[js/missing-rate-limiting] - feature gate only, not authentication
+// Feature gate only, not authentication
 router.use(adminEnabledMiddleware)
 router.use('/assets', express.static('./resources/admin/assets'))
 router.get('/', getAdminDashboardRequestHandler)
@@ -74,7 +74,6 @@ router.get(
   adminAuthMiddleware,
   withAdminController(createGetAdminSettingsSchemaController),
 )
-// codeql[js/missing-rate-limiting] - adminRateLimitMiddleware applies Redis-backed admin rate limits
 router.patch(
   '/settings',
   adminRateLimitMiddleware,
@@ -83,7 +82,6 @@ router.patch(
   adminAuthMiddleware,
   withAdminController(createPatchAdminSettingsController),
 )
-// codeql[js/missing-rate-limiting] - adminRateLimitMiddleware applies Redis-backed admin rate limits
 router.post(
   '/settings/validate',
   adminRateLimitMiddleware,

src/routes/index.ts

@@ -15,21 +15,18 @@ import { hasExplicitNostrJsonAcceptHeader, rootRequestHandler } from '../handler
 const router: Router = express.Router()
 
 // Public NIP-11 / homepage — advertises relay metadata only; not an authentication endpoint.
-// codeql[js/missing-rate-limiting]
 router.use((req, res, next) => {
   if (req.method === 'GET' && req.path === '/' && hasExplicitNostrJsonAcceptHeader(req)) {
     return rootRequestHandler(req, res, next)
   }
   next()
 })
 
-// codeql[js/missing-rate-limiting]
 router.get('/', rootRequestHandler)
 // Liveness: process is running (always 200). Used for "is the container up?" checks.
 router.get('/healthz', getHealthRequestHandler)
 router.get('/privacy', getPrivacyRequestHandler)
 // Readiness: Postgres + Redis must respond. Used before routing traffic during deploys.
-// codeql[js/missing-rate-limiting]
 router.get('/readyz', getReadyzRequestHandler)
 router.get('/terms', getTermsRequestHandler)