ci: add CodeQL analysis workflow

[natoscott]

Summary

• add explicit CodeQL analysis for Actions, JavaScript/TypeScript, and Python
• report the required Analyze (...) check contexts on pull requests
• run analysis on pushes to main and weekly on schedule

Validation

• actionlint .github/workflows/codeql.yml passed
• YAML structure validation passed
• commit includes a DCO sign-off

Summary by CodeRabbit

• Chores
  • Added automated security analysis for application code and workflows. Checks run when changes are pushed to or submitted for review against the main branch, and on a weekly schedule. Analysis covers Actions, JavaScript/TypeScript, and Python. The results help identify potential security issues during ongoing development.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: redhat-performance/configiq/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 76548d99-0506-4943-b324-d3f31ae732ed

📥 Commits

Reviewing files that changed from the base of the PR and between 40c724e and e2e72f5.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow that runs CodeQL analysis on pushes and pull requests to main, and on a weekly schedule. The workflow analyzes Actions, JavaScript/TypeScript, and Python.

Changes

CodeQL analysis

Layer / File(s)	Summary
Configure and run CodeQL analysis .github/workflows/codeql.yml	Adds push, pull request, and weekly triggers. Grants read access to actions and repository contents, and write access to security events. Runs CodeQL analysis for Actions, JavaScript/TypeScript, and Python in a matrix with fail-fast disabled.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to e2e72

The workflow adds the intended CodeQL checks without a demonstrated credential-exposure path. No actionable merge blocker remains beyond normal checks.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a CodeQL analysis workflow.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}