ci(codeql): analyse the Actions workflows and scan on any workflow change

[mrbobbytables]

Security hardening

.github/workflows/codeql.yml initialised CodeQL with javascript-typescript only, so none of the ten workflow files were statically analysed. Its paths: filters also named only codeql.yml itself, so a PR editing architecture-submission.yml (which runs on issues: [labeled] with contents: write and interpolates issue-derived values into action inputs) never started a scan.

What changes

• .github/workflows/codeql.yml
  • jobs.analyze gains strategy.matrix.language: ['javascript-typescript', 'actions'] with fail-fast: false; languages: and category: read ${{ matrix.language }}; the job name becomes Analyze ${{ matrix.language }}.
  • Both paths: lists replace .github/workflows/codeql.yml with .github/workflows/**, so editing any workflow starts the scan. (.github/actions/ does not exist here, so it is not listed.)
  • Action SHA pins, permissions:, runs-on, timeout-minutes, build-mode: none, persist-credentials: false and the schedule are unchanged.
• tests/codeql-contract.test.mjs pins the new shape: both languages must be in the matrix with fail-fast: false, init/analyze must read the matrix and name it in the category, and .github/workflows/** must be in the path filters. With the workflow change reverted, 3 of the contract's 10 tests fail.

Notes for review

• CodeQL is not a required status check (the rulesets require only "Validate repository" and "Lint repository"), so the first actions run can raise alerts to triage in the Security tab without blocking the queue. The check name changes from Analyze JavaScript to Analyze javascript-typescript / Analyze actions; nothing in the repository references the old name.
• Verified locally: tests/codeql-contract.test.mjs, ci-supply-chain, workflow-scripts and ci-concurrency suites pass (56 tests); check:format and check:spelling clean.

Closes #1302

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[hivecommons-hive]

1e791e6

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @mrbobbytables, head 1e791e66169b) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/codeql.yml
• ci_gate_weakening — CI configuration is deleted, softened or has gate checks removed (Disables or softens CI gates (continue-on-error, || true, removed checks))
  • .github/workflows/codeql.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.