ci: add CodeQL code scanning

[wizzomafizzo]

Summary

• Add CodeQL workflow with security-extended query suite
• Triggers on PRs, pushes to main, and weekly schedule
• Uses none build mode (TypeScript)
• Dependency caching enabled

Summary by CodeRabbit

• Chores
  • Configured automated security code scanning to run on code pushes, pull requests, and scheduled intervals.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow is added to enable CodeQL security analysis for JavaScript and TypeScript code. The workflow triggers on pushes to main, pull requests targeting main, and scheduled runs, executing security-focused code analysis on each trigger.

Changes

Cohort / File(s)	Summary
CodeQL Security Workflow .github/workflows/codeql.yml	New GitHub Actions workflow that initializes and runs CodeQL analysis with security-extended queries for JavaScript/TypeScript, triggered on pushes to main, pull requests, and a Monday cron schedule.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 A guardian workflow takes its stand,
CodeQL's watchful eye across the land,
Each push and PR, security's call—
A curious rabbit protects it all! 🔍✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: add CodeQL code scanning' is directly related to the main change: adding a new GitHub Actions workflow for CodeQL security analysis.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/codeql

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/codeql.yml:
- Around line 11-13: The CodeQL workflow's permissions block is missing the
actions permission which is required for private repos; update the permissions
mapping in the CodeQL workflow (the permissions: block in the codeql.yml) to
include actions: read alongside contents: read and security-events: write so
workflow metadata can be accessed; ensure the new entry follows YAML indentation
and ordering consistent with the existing permissions keys.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bf8ac5c7-e6ac-4bbf-bf5a-820d06baedae

📥 Commits

Reviewing files that changed from the base of the PR and between 1077403 and 548af24.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml