Add CodeQL analysis workflow

[pkthong]

Added codeql.yml to allow codeql to run now that this is a public repo.

[ni-github-admins]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

🟡 Changes recommended

The workflow YAML has indentation errors that will prevent the matrix and steps from executing as intended.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a GitHub Actions workflow to enable CodeQL code scanning for this now-public repository.

Changes:

• Introduces a new .github/workflows/codeql.yml workflow to run CodeQL on pushes/PRs to main and on a weekly schedule.
• Configures CodeQL analysis for actions and python.

File summaries

File	Description
.github/workflows/codeql.yml	Adds CodeQL scanning workflow for GitHub Actions + Python.

Review details

Suppressed comments (2)

.github/workflows/codeql.yml:60

• steps: is indented correctly, but the step list items are not nested under it (they are aligned with steps:), which makes the workflow YAML invalid. This also updates checkout to match the repo’s existing SHA-pinning pattern (e.g., .github/workflows/run_unit_tests.yml:23).

    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

.github/workflows/codeql.yml:90

• The remaining steps (manual build + analyze) are also not nested under steps: due to indentation, so they won’t execute even if YAML parses. These should be indented to be part of the steps list.

    - name: Run manual build steps
      if: matrix.build-mode == 'manual'
      shell: bash
      run: |

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.