ci: add CodeQL analysis

[ProfRandom92]

Summary:

• Add a new GitHub Actions CodeQL workflow at .github/workflows/codeql.yml that runs on pull_request, push to main, and a weekly cron schedule, and configures analysis for python and javascript-typescript using github/codeql-action/init@v3 and github/codeql-action/analyze@v3 with build-mode: none and no codeql/autobuild step.

Changed files:

• .github/workflows/codeql.yml

Testing:

• Ran python scripts/run_checks.py, which completed successfully and produced docs/reports/check-report.md during the run; the generated report was reverted to keep the change scoped to the workflow file.

Risks:

• Low risk since the change only adds a CI workflow and does not modify source code or runtime behavior.

Next:

• Allow GitHub Actions to validate the workflow on the next PR or scheduled run and iterate if any workflow adjustments are required.

---

Codex Task

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.