fix(ci): align CodeQL with actions-only analysis

Drop leftover JS/TS path filters and dual query suites that disagreed
with the actions language matrix, and include composite actions paths.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bolens

.github/workflows/codeql.yml

@@ -9,104 +9,50 @@ on:
     branches: [ main ]
     paths:
       - '.github/workflows/**'
-      - '**/*.js'
-      - '**/*.ts'
-      - '**/*.mjs'
-      - '**/*.cjs'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
+      - '.github/actions/**'
       - '.github/workflows/codeql.yml'
   pull_request:
     branches: [ main ]
     paths:
       - '.github/workflows/**'
-      - '**/*.js'
-      - '**/*.ts'
-      - '**/*.mjs'
-      - '**/*.cjs'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
+      - '.github/actions/**'
       - '.github/workflows/codeql.yml'
   schedule:
     # Run weekly on Mondays at 2 AM UTC
     - cron: '0 2 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
-      issues: write
       security-events: write
-      pull-requests: write
 
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'actions' ]
+        include:
+          - language: actions
+            build-mode: none
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ matrix.language }}
-        queries: security-extended,security-and-quality
-
-    - name: Perform CodeQL Analysis
-      id: analyze
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: "/language:${{matrix.language}}"
-        upload: true
-
-    - name: Comment PR with CodeQL Results
-      if: github.event_name == 'pull_request' && steps.analyze.outcome == 'success'
-      uses: actions/github-script@v9
-      with:
-        script: |
-          const body = `🔍 **CodeQL Analysis Complete** (${{ matrix.language }})
-          
-          CodeQL analysis has completed successfully. Results are available in the **Security** tab of this PR.
-          
-          **Language Analyzed:** ${{ matrix.language }}
-          **Query Suite:** security-extended, security-and-quality
-          
-          📋 **View Results:**
-          - Check the Security tab above for detailed findings
-          - Review any alerts and address them before merging
-          
-          > **Note:** CodeQL does not natively support PowerShell. This analysis covers GitHub Actions workflows in \`.github/workflows\`.
-          
-          *Analysis performed automatically by CodeQL*`;
-          
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: body
-          });
-
-    - name: Comment PR with CodeQL Errors
-      if: github.event_name == 'pull_request' && steps.analyze.outcome == 'failure'
-      uses: actions/github-script@v9
-      with:
-        script: |
-          const body = `❌ **CodeQL Analysis Failed** (${{ matrix.language }})
-          
-          CodeQL analysis encountered an error. Please check the workflow logs for details.
-          
-          **Language:** ${{ matrix.language }}
-          
-          *Check the workflow run for error details.*`;
-          
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: body
-          });
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          # security-and-quality includes security-extended for Actions workflows
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"