[Madraka]

What

Sets up GitHub code scanning with CodeQL (.github/workflows/codeql.yml + .github/codeql/codeql-config.yml). The repository had none ("no analysis found" on the code-scanning API). Three analyses run as a matrix on every pull request, on every push to main and weekly (Monday 05:17 UTC):

• javascript-typescript (build-mode: none),
• rust (build-mode: none): Rust is generally available in CodeQL (editions 2021 and 2024, TypeScript up to 7.0); GitHub's own default setup analyses Rust without a build, and the extractor only needs the rustup/cargo already on ubuntu-latest. Nothing on the free tier of a public repository limits it, so it is on. If it ever turns out slow or noisy, drop the matrix row.
• actions: CodeQL's workflow-injection and untrusted-checkout queries for .github/workflows.

Details:

• permissions: {} at the top, contents: read + security-events: write on the job (packages: read and actions: read only matter on private repositories).
• Actions pinned to commit SHAs with the version in a comment, like release.yml: actions/checkout v7.0.1 (the SHA already used there) and github/codeql-action v4.39.3 (33d7b85…, the commit refs/tags/v4.39.3 dereferences to). Dependabot's github-actions entry keeps them current.
• timeout-minutes: 30, fail-fast: false, concurrency per ref with cancel-in-progress.
• The config excludes **/generated/** (schema output, i18n params), apps/studio/src/i18n/loaders/**, **/fixtures/**, **/dist/**, **/__snapshots__/**, target/**, .i18n/** and node_modules, so findings point at hand-written code.

Owner action: for results to appear under Security › Code scanning (and as PR checks), the repository's default setup must stay off (advanced setup and default setup conflict), and code scanning must be enabled for the repository: Settings › Code security › Code scanning. On a public repository this is free and usually on by default once a workflow uploads a SARIF; if the first run fails at the upload step with a "code scanning is not enabled" error, enable it there and re-run. The first PR run will show the three Analyze (…) checks on this PR.

Checklist

• pnpm lint passes on the new files (Biome does not format YAML here, biome.json); pnpm check and cargo test do not apply to a workflow-only change
• Contract change? No
• User-visible change in a published package? No (no changeset)
• Commits are signed off (git commit -s, DCO)
• Docs / AGENTS.md updated if behaviour or commands changed: nothing to update; the workflow header documents itself

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.