[dangrondahl]

Closes #91.

What

.github/workflows/codeql.yaml, modelled on terraform-provider-kosli's. It includes the analyze job only.

• Languages: javascript-typescript (src/, scripts/, test/) and actions (the workflows). Both use build-mode: none, so there's no build step.
• Queries: security-extended.
• Triggers: PRs and pushes to main, plus a weekly re-scan (Wednesdays 05:23 UTC).
• Concurrency: superseded PR runs are cancelled. Runs on main aren't, so the code scanning baseline always gets its SARIF.
• Permissions: contents: read at the top level. The job adds security-events: write and actions: read.
• Repo conventions: SHA pins with version comments and harden-runner first, as in every other workflow here. It needs no secrets, so there's no fork guard. Dependabot's actions group will keep the pins current.
• Docs: CLAUDE.md's workflow list goes from four to five.

codeql-action is pinned to v4.39.0, the provider's pin, rather than v4.39.1. v4.39.1 is two days old, which is inside the repo's 7-day cooldown; Dependabot will offer it.

Not in this PR (per #91)

• Kosli attestation: the provider's attest job, which needs a Kosli flow and trail for this repo.
• Required check: making CodeQL a required check in the main ruleset. Decide that after a few runs.

Checking it

• actionlint passes on every workflow.
• Unlike claude-review.yaml, this workflow runs on the PR that adds it, so this PR's own checks are the first scan. Look at Security → Code scanning afterwards, and fix or dismiss with a reason anything the first full scan raises (the issue's "done when").

[claude]

Claude finished @dangrondahl's task in 2m 14s —— View job

---

Review: ci: add CodeQL code scanning

• Read PR diff and CLAUDE.md invariants
• Check workflow against repo conventions (SHA pins, harden-runner, permissions, fork safety)
• Verify action pins and CodeQL config correctness
• Check CI results
• Post review

No blocking findings. I have no inline comments to leave.

What I checked

Repo conventions (CLAUDE.md "CI & repository rules")

• All three uses: are full SHAs with # vX.Y.Z comments, and harden-runner / actions/checkout are pinned to the same SHAs already used by ci.yml, release.yml, update-catalog.yml and claude-review.yaml — so Dependabot's grouped actions PR will move them together rather than leaving this file behind.
• step-security/harden-runner is the first step with egress-policy: audit, matching every other job.
• No secrets are used, so the fork guard rule (head.repo.full_name == github.repository) correctly does not apply here. Top-level permissions: contents: read with the job narrowing to security-events: write + actions: read is least-privilege and consistent with the rest of the repo.

Correctness of the CodeQL config

• build-mode: none is right for both javascript-typescript and actions; fail-fast: false means one language failing doesn't suppress the other's SARIF.
• category: "/language:${{ matrix.language }}" keeps the two matrix legs from overwriting each other's results — easy to get wrong, correct here.
• The concurrency expression does what the comment claims: PR runs group on pull_request.number and cancel; push/schedule on main group on refs/heads/main with cancel-in-progress: false, so the baseline always gets uploaded. Scheduled and push runs on main queue rather than cancel, which is the behaviour you want.
• cron: '23 5 * * 3' is Wednesday 05:23 UTC, as described.
• Both Analyze (javascript-typescript) and Analyze (actions) pass on this PR (52s / 1m4s), which also confirms the pinned SHA resolves, security-extended resolves for both languages, and that code scanning default setup isn't enabled on the repo (it would have rejected the advanced-config SARIF).

Scope and docs

• The diff is exactly the two files the description claims; nothing touches src/, the catalog, the three-tool design, or the org-resolution rules.
• The CLAUDE.md edit is accurate: four → five workflows, and the summary of what codeql.yaml does matches the file (including flagging it as advisory rather than a required check).
• Commit message and PR title are Conventional Commits (ci:), and the commit body explains the v4.39.0-vs-v4.39.1 pin choice against the 7-day cooldown — that reasoning is worth having in the history.

Two small things, neither worth blocking on: pull_request here is filtered to branches: [main] while ci.yml uses a bare pull_request:, so a PR targeting any other branch gets CI but no CodeQL; and since this runs unguarded on fork PRs, it's worth confirming on the first external contribution that the SARIF upload doesn't trip over the read-only token — if it does, the fix is a skip condition on the upload, not a fork guard on the whole job.

Nicely done overall: the comments explain the non-obvious choices (why main runs aren't cancelled, why actions: read is there, why the actions language matters given the review workflow runs an LLM with a token in scope) instead of restating the YAML.
· branch ci/codeql

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.