Configure CodeQL to analyze TypeScript only, remove Actions scanning

[Copilot]

Success criteria

• CodeQL workflow analyzes TypeScript code only
• GitHub Actions workflows are not scanned by CodeQL
• ESM build output is analyzed as configured
• Workflow runs without language configuration errors

How to test

1. Push changes to main or open a PR to trigger CodeQL workflow
2. Verify workflow runs successfully with TypeScript language scanner only
3. Confirm CodeQL results show analysis of dist/webchat.esm.js
4. Check no Actions language analysis is performed

Security

• Possible injection vector
• Authentication/Access controls touched
• Sensitive Data could be exposed
• XSS
• Logging/Monitoring touched
• Exchanges data with external systems
• No security implications

Additional considerations

• This PR might have performance implications

Documentation Considerations

CodeQL now scans TypeScript code from the ESM build output only. Actions workflow files are excluded from scanning per repository requirements.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[graymalkin77]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• download.cypress.io
  • Triggering command: /usr/local/bin/node node index.js --exec install (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)