Add and validate CodeQL scanning

[konard]

Summary

• add a CodeQL status badge to the README
• add scheduled, push, and pull-request CodeQL analysis for C/C++ and C#
• use current action runtimes and build-free extraction, leaving compilation and tests to the dedicated language workflows
• add policy tests that guard the workflow's language identifiers, action versions, runner pin, and least-privilege checkout configuration

Fixes #139.

CI investigation

A fresh run reproduced the existing C/C++ failure: CMake could not find GTest and therefore could not resolve GTest::gtest. The workflow also used deprecated action/runtime versions and a manual build that duplicated the repository's language CI.

The final workflow uses CodeQL v4 with build-mode: none. This removes the failing duplicate build while still producing complete CodeQL databases for both supported languages.

• Before: C/C++ CodeQL failure
• After: passing CodeQL run

Verification

• node --test .github/scripts/*.test.mjs — 30 tests passed
• actionlint .github/workflows/codeql.yml — passed
• node .github/scripts/check-readme-badges.mjs — passed
• strict C# validation — build completed with 0 warnings/errors, 2 tests passed, package contents validated
• local C++ build and test — 7 tests passed
• pull-request CI — CodeQL C/C++, CodeQL C#, C#, documentation, README badges, and Codacy passed
• uploaded CodeQL analyses contain 179 C/C++ rules and 164 C# rules, with no alerts

No package version change is needed because this change only affects CI and documentation.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[konard]

We also need to make sure CI/CD fill pass by fixing all issues.

[konard]

🤖 AI Work Session Started

Starting automated work session at 2026-09-20T07:46:53.614Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback.

Runtime: solve v2.29.0 · tool codex · model gpt-5.6-sol · task image konard/hive-mind-dind:2.29.0@sha256:11a236d03854cbaea86fdd7ca06265c912cf0b67d1fcc9b3eb60bd84c43ff749

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[konard]

Working session summary

Implemented and finalized PR #148.

• Added the CodeQL badge and C/C++ plus C# scanning.
• Fixed the failing C++ analysis by using CodeQL v4 build-free extraction.
• Added workflow regression tests.
• Merged the latest main.
• All required CI checks pass; CodeQL analyzed 179 C/C++ and 164 C# rules with no alerts.
• Updated the PR title/description and marked it ready for review.
• Branch is clean, pushed, current, and mergeable.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $6.987995

📊 Context and tokens usage:

• 171.6K / 200K (86%) input tokens, 27.1K / 128K (21%) output tokens

Total: (171.6K + 6.0M cached) input tokens, 27.1K output tokens, $6.987995 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: xhigh (~31999 tokens)
• Model: GPT-5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (2570KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag