ci: scan fork pull requests with CodeQL

[goldmar]

Summary

• add an advanced CodeQL workflow for GitHub Actions and JavaScript/TypeScript
• run on pushes to main, pull requests (including forks), and a weekly schedule
• use pinned GitHub-owned actions and least-privilege permissions

Why

CodeQL default setup intentionally excludes fork pull requests, while the repository ruleset requires Analyze (javascript-typescript). That makes otherwise-green fork contributions impossible to merge. The committed advanced workflow runs from the trusted base workflow definition and does not install dependencies or execute contributor code.

Verification

• actionlint .github/workflows/codeql.yml
• pnpm check-static-guardrails
• git diff --check

[github-actions]

Bundle Size Report

File	Size	Limit	Status
dist/index.js	527.7 KB	600 KB	✅ Within limit

Bundle is within the 600 KB limit.

[greptile-apps]

Greptile Summary

This PR adds an advanced CodeQL workflow for the repository. The main changes are:

• Scans GitHub Actions and JavaScript/TypeScript.
• Runs for pushes to main, pull requests, and a weekly schedule.
• Uses pinned actions with read-only contents access and SARIF upload permission.

Confidence Score: 5/5

This looks safe to merge after resolving the existing fork upload concern.

No additional blocking issues were found in the changed code.

.github/workflows/codeql.yml

T-Rex Logs

What T-Rex did

• T-Rex checked that the base revision did not contain the .github/workflows/codeql.yml file by reviewing the before-state log.
• T-Rex examined the after-state log, confirming the exact workflow path, diff range, the command outputs, and per-step exit codes, with an overall exit code of 0.
• T-Rex retained separate fresh logs for each requested check to enable independent review.
• T-Rex validated the general contract by aligning the after-state evidence with the stated expectations of the codeql workflow validation.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/codeql.yml	Adds the CodeQL triggers, permissions, language matrix, checkout, initialization, and analysis steps.

_{Reviews (2): Last reviewed commit: "test: restore CodeQL main scope" | Re-trigger Greptile}