Add actions analysis to code scanning

[aeisenberg]

This enables the new actions analysis queries for this repository.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.

[Copilot]

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Tip: Copilot only keeps its highest confidence comments to reduce noise and keep you focused. Learn more

[angelapwen]

I'm actually a little confused by this workflow file but I think we actually need to add the matrixed language variable in the 2nd build job rather than the first check-codeql-versions job:

codeql-action/.github/workflows/codeql.yml

Line 93 in e7c0c9d

languages: javascript

and maybe

codeql-action/.github/workflows/codeql.yml

Line 102 in e7c0c9d

category: "/language:javascript"

to update the category?

We can see that currently the build job only runs with javascript: https://github.com/github/codeql-action/actions/runs/12958590934/job/36149344474

I'm not sure we care about the languages specified in check-codeql-versions job but maybe it doesn't hurt to include both actions and javascript there too.

[aeisenberg]

Hmmm...I think you're right. I was just being lazy, making changes, and hoping it would work out. I should be thinking deeper about this.

It might just be easier to create a separate job for the actions run. I don't think we need to matrix it over multiple OSes.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[aeisenberg]

Seems like it worked!

[angelapwen]

Do we also want this job to depend on check-codeql-versions? I guess it's not necessary, as long as one of them depends on it?

[aeisenberg]

I was thinking that we don't need it.

This workflow is matrixed on multiple versions of CodeQL mainly as an integration test. Since we're using the different versions for analyzing JavaScript, I was thinking that we don't need to do the same for actios. Though, if you can think of a reason, we can change this.

[aeisenberg]

I changed the name of the job from build to analyze. So, there are still 12 expected checks. If we want to get this through, then I'll update the required jobs.