CI/CD: Set up CodeQL static analysis workflow

[edsonesf]

User Story

As a developer, I want CodeQL static analysis running in CI so that security vulnerabilities are detected automatically and branch protection can enforce code scanning results.

Acceptance Criteria

• .github/workflows/codeql.yml created
• CodeQL analyses Python code on every push and pull request to main
• Results visible in GitHub Security tab
• Branch protection rule "Require code scanning results" re-enabled on main

Notes

CodeQL was enabled in branch protection but the workflow was never created, blocking PR merges. This issue tracks setting it up properly.

Default CodeQL workflow for Python is sufficient — no custom queries needed for this project.

[edsonesf]

Implementation Guide for Jules

Context — why this matters

This project is implementing a layered DevSecOps security pipeline. This issue (#96) is the first step. The full security stack being built is:

#	Tool	Type
#96	CodeQL	SAST — this task
#97	Semgrep	SAST
#98	pip-audit	SCA
#99	Schemathesis	DAST
#100	Trivy	Container scan

Each will be implemented sequentially. Focus only on #96 for now.

Academic reference: Shetty, A.A. (2024) Monitoring the Security Vulnerabilities in CI/CD Pipeline Using DevSecOps Security Testing Tools, NCI. https://norma.ncirl.ie/8154/1/aniketashokshetty.pdf

---

Before writing any code

Read these files:

• README.md — project overview and structure
• CONTRIBUTING.md — code standards, commit format, branch naming
• .github/workflows/ci.yml — existing CI pipeline to understand the pattern

---

Task: Create CodeQL workflow

Create .github/workflows/codeql.yml that:

1. Triggers on push and pull_request to main
2. Uses the standard GitHub CodeQL action for Python
3. Uploads results to GitHub Security tab (SARIF)
4. Runs after the existing CI checks (not blocking them)

Use the official GitHub CodeQL starter workflow as the base — it handles Python automatically.

---

Commit and PR

• Branch: feat/codeql-scanning
• Commit: ci: add CodeQL static analysis workflow
• PR title: ci: add CodeQL static analysis workflow (#96)
• PR must reference Closes #96
• All existing CI checks must pass

Notes

• CodeQL workflow file only — no changes to application code
• Once this PR is merged, the branch protection rule "Require code scanning results" will be re-enabled on main

[edsonesf]

@jules is working on this task.

[edsonesf]

Finding: CodeQL requires GitHub Advanced Security on private repos

Problem: CodeQL cannot upload results on private repositories without a paid GitHub Advanced Security license. The workflow runs and scans correctly but fails at the upload step with:

"Code scanning is not enabled for this repository"

Options evaluated:

Option	Pros	Cons
Make repo public	CodeQL free, Semgrep free, supervisor access easier	Repo becomes publicly visible
Keep private + pay	Full CodeQL	Costs money — not justified for academic project
Keep private + drop CodeQL	No cost	Lose deep semantic analysis

Decision: See ADR-021 in docs/design-decisions.md.

References:

• Gemini analysis confirming the limitation
• https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning

GitHub is blocking the CodeQL upload because code scanning is disabled at the repository level. If your repository is private, CodeQL requires a paid GitHub Advanced Security license; if it is public, it is free, but you still need to enable it and set the correct workflow permissions.

Option 1: Enable CodeQL (Best if the repo is Public or you have a paid license)
Option 2: Change to Public Visibility (Free CodeQL)
Option 3: Use Free Python Linters (Best if repo must stay Private)

[edsonesf]

PR #107 closed — CodeQL not viable on private repo

PR #107 (Jules' CodeQL workflow) has been closed without merging. CodeQL requires GitHub Advanced Security on private repositories — not available on GitHub Free.

Decision: Rework this issue with alternatives that work on private repos:

• Bandit — Python SAST, runs locally and in CI, no GitHub Advanced Security required
• Semgrep (CI/CD: Add Semgrep SAST security scanning to pipeline #97) — SAST with OWASP rules, works on private repos
• pip-audit (CI/CD: Add pip-audit SCA dependency vulnerability scanning #98) — SCA dependency scanning

ADR-021 documents the full context and decision rationale.

Related: #113 (discuss repo visibility with supervisor), #114 (Copilot auto-review not triggering)