Internal - Add CodeQL scanning for GitHub Actions workflows

[cleverchuk]

TLDR

Extends the existing CodeQL security scanning to also analyze GitHub Actions workflow files for vulnerabilities such as script injection and unsafe use of untrusted input.

Details

CodeQL supports an actions language target that statically analyzes workflow YAML files for security anti-patterns — most notably ${{ }} expression injection in run: blocks, use of mutable tags, and overly broad permissions.

The actions language does not require a build step, so the existing Java build steps (JDK setup, Gradle setup, Gradle build) are now conditional on matrix.language == 'java' to avoid unnecessary work in the actions analysis job.

The language matrix now produces two parallel jobs:

• java — compiles the project and runs CodeQL semantic analysis on Java source
• actions — runs CodeQL static analysis on workflow definitions without a build

Test services data

1. e-1712644058766987264
2. e-1712643928659124224
3. e-1742334541200846848
4. e-1777406072376840192

[Copilot]

Pull request overview

Extends the existing CodeQL code-scanning workflow to also analyze GitHub Actions workflow YAML files (the actions CodeQL language), while avoiding unnecessary Java build steps for the actions scan.

Changes:

• Expand the CodeQL language matrix from java to java + actions.
• Make JDK/Gradle setup and the Gradle build conditional so they only run for the java matrix entry.

[jerrytfleung]

LGTM