[cliffhall]

Closes #2545

CodeQL default setup scans only the default branch (main) and PRs into it, so no v2/main work was scanned until the milestone-merge PR. That is where the v2.9.0 ReDoS (#2540) surfaced.

Changes

• .github/workflows/codeql.yml: advanced setup. Runs on push and pull_request for main and v2/main, plus the weekly schedule. Same languages (actions, javascript-typescript), default query suite, build-mode: none. Checkout uses persist-credentials: false. timeout-minutes: 10 is sized from 30 observed default-setup runs (slowest job about 4.7 min, doubled and rounded up).
• verify:action-pins now counts security-events: write as credentialed. Before this change the guard would not have treated this job as credentialed, so the pins the issue requires would have gone unenforced. That scope uploads the scan results, so a moved tag could silently drop every alert. checkout and codeql-action init/analyze are pinned via npm run action:resolve-pin. The guard's test now includes a security-events: write job. Mutation check: replacing the analyze pin with @v4 makes the guard fail.
• docs/quality-gate.md: a paragraph on the new workflow.

Default setup

Default setup is a repo setting, and GitHub rejects advanced-setup uploads while it is on. Per the maintainer's call, it is being disabled right after this PR opens, so this PR's own run proves the workflow on a v2/main-targeted PR. Until the v2.12.0 milestone merge carries this file to main, main gets no push or scheduled scans. The milestone PR itself is still scanned, because pull_request runs from the PR's ref.

npm run local:gate is green.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The workflow and pin-enforcement changes are consistent, have focused regression coverage, and have no unresolved findings.

No open issues 🎉

What changed in this PR

Adds committed CodeQL scanning so v2/main changes are checked before milestone merges into main.

Changes:

• Adds SHA-pinned CodeQL scans for pushes, pull requests, and a weekly schedule.
• Extends action-pin enforcement to security-events: write, with regression coverage.
• Documents the workflow and requirement to disable default setup.

File	Description
scripts/​verify-action-pins.test.mjs	Tests scan-upload permissions as credentialed.
scripts/​verify-action-pins.mjs	Requires immutable action pins for scan-upload jobs.
docs/​quality-gate.md	Documents CodeQL coverage and setup requirements.
.github/​workflows/​codeql.yml	Adds scanning for both development and release branches.

_{Review effort: Balanced}

[cliffhall]

Copilot review loop closed: round 1 was clean (no inline comments, no suppressed findings, 'Approval recommended'), so no further rounds.

The PR's own CodeQL run uploaded both analyses (actions, javascript-typescript) against refs/pull/2741/merge. Default setup is now not-configured.