[RaananW]

Summary

• add an advanced CodeQL workflow for static JavaScript/TypeScript and GitHub Actions analysis on master pushes, pull requests, merge groups, weekly schedule, and manual dispatch
• use the normal pull-request merge revision, minimal job permissions, GitHub-hosted runners, disabled credential persistence/dependency caching, security-extended, and full verified action commit pins
• document the managed-to-advanced migration, benign fork validation, required-check and code-scanning gate setup, recovery, Dependabot behavior, and future merge-queue verification in .github/CODEQL_MIGRATION.md
• intentionally omit C# scanning at the user's direction; no application or example source file was deleted or modified

Validation

• actionlint 1.7.12
• PyYAML 6.0.3 parsing
• explicit workflow policy assertions for events, two-language matrix, minimal permissions, forbidden triggers/options, and exact action pins
• git diff --check

Deployment status and boundaries

Managed CodeQL default setup remains enabled. Advanced uploads cannot coexist with default setup during this transition, so this PR only prepares the reviewed workflow and owner runbook.

The advanced baseline, authorized benign fork-PR scan, required-check execution gate, qualifying-alert threshold gate, Dependabot upload, and merge-queue gate remain unverified until the separately authorized cutover and validation steps in the runbook are completed.

Opening this PR does not authorize repository or organization settings changes, merging, contributor workflow approvals, manual workflow dispatch, test-fork creation, or weakening any existing protection.

[Copilot]

🟡 Changes recommended

The migration guide overstates security guarantees because fork PRs can modify the evaluated workflow and inline configuration, and returning contributors may not encounter the stated approval prompt.

1 open issue

• Do not treat PR workflow config as a trusted default-branch boundary · New

What changed in this PR

Prepares advanced CodeQL scanning for fork pull requests without changing application code or activating the managed-to-advanced cutover.

Changes:

• Adds JavaScript/TypeScript and GitHub Actions analysis for master pushes, pull requests, merge groups, scheduled runs, and manual dispatch.
• Uses pinned actions, minimal job permissions, static extraction, and disabled credential persistence and dependency caching.
• Documents owner-authorized migration, validation, merge gates, and recovery; deployment verification remains pending.

File	Description
.github/​workflows/​codeql.yml	Adds the two-language advanced CodeQL workflow.
.github/​CODEQL_MIGRATION.md	Records migration steps, safety properties, validation requirements, and recovery procedures.

_{Review effort: Balanced}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.