Add CodeQL workflow for automated security analysis

[Copilot]

Success criteria

Please describe what should be possible after this change. List all individual items on a separate line.

• CodeQL security analysis runs automatically on push to main and pull requests
• The library is built before analysis to enable comprehensive code scanning
• Weekly scheduled scans provide ongoing security monitoring
• Security vulnerabilities are detected and reported in GitHub Security tab

How to test

Please describe the individual steps on how a peer can test your change.

1. Push changes to main or create a PR targeting main
2. Verify the "CodeQL" workflow appears in Actions tab
3. Confirm workflow completes: installs dependencies → builds library → runs analysis
4. Check that security findings (if any) appear in Security → Code scanning alerts

Security

• Possible injection vector
• Authentication/Access controls touched
• Sensitive Data could be exposed
• XSS
• Logging/Monitoring touched
• Exchanges data with external systems
• No security implications

Additional considerations

• This PR might have performance implications

Documentation Considerations

These are hints for the documentation team to help write the docs.

CodeQL workflow now scans JavaScript/TypeScript codebase using security-extended and security-and-quality query packs. Analysis runs after building the library with npm run build to ensure complete code coverage.

Original prompt

add a codeQL action to the pipeline which builds the library and runs analysis against the build

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

@graymalkin77 Unfortunately I hit an unexpected error while processing your comment. I've automatically reported this to GitHub.

You can ask me to try again later by mentioning me in a new comment.

If you want to contact GitHub about this error, please mention the following identifier so they can better serve you: 7776d0a0-8a2c-4065-9de9-05fa8102a195

Sorry for the inconvenience!