ci: add CodeQL static analysis workflow (#96)

[edsonesf]

Summary

Set up CodeQL static analysis workflow for Python to automatically detect security vulnerabilities.

Changes

• Created .github/workflows/codeql.yml
• Configured CodeQL to trigger on push and pull_request to main
• Set build-mode: 'none' for Python
• Used @v4 for CodeQL actions to avoid Node.js deprecation warnings

Checklist

• ruff check . passes
• ruff format --check . passes
• PYTHONPATH=src mypy src/app/ passes
• pytest passes
• No hardcoded secrets
• Commit messages follow the standard

Closes

Closes #96

Related

Related to #96

---

PR created automatically by Jules for task 8366374558368559323 started by @edsonesf

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[edsonesf]

@jules you did not follow the PR templates to open #107

[edsonesf]

@copilot Claude Haiku 4.5 - Review

---

PR Review — PR #107

ci: add CodeQL static analysis workflow (#96)

Status	🟡 Draft — Open (mergeable, but behind main)
Author	@edsonesf
Assignee	@edsonesf
Requested Reviewer	@edson-esf
Changes	1 file, +38 additions
Commits	5
Comments	2
Label	ci-cd
Milestone	S2 — CI/CD & Backend Skeleton

---

Core Changes

The PR now has an improved description with explicit verification of local checks:

## Summary
Set up CodeQL static analysis workflow for Python to automatically detect security vulnerabilities.

## Changes
- Created `.github/workflows/codeql.yml`
- Configured CodeQL to trigger on `push` and `pull_request` to `main`
- Set `build-mode: 'none'` for Python
- Used `@v4` for CodeQL actions to avoid Node.js deprecation warnings

## Checklist
- [x] `ruff check .` passes
- [x] `ruff format --check .` passes
- [x] `PYTHONPATH=src mypy src/app/` passes
- [x] `pytest` passes
- [x] No hardcoded secrets
- [x] Commit messages follow the standard

The workflow file itself remains the same — a well-configured CodeQL action for Python analysis with proper permissions and matrix configuration.

---

What Changed Since Last Revision

✅ Improvements Made:

1. Enhanced PR description — Now includes explicit sections (Summary, Changes, Checklist)
2. Verification checklist — Documents that all local linting, type-checking, and test suites passed
3. Security confirmation — Explicitly states no hardcoded secrets
4. Reviewer assignment — Added @edson-esf as requested reviewer
5. Issue linking — Properly closes CI/CD: Set up CodeQL static analysis workflow #96 with explicit reference

---

Merge Readiness Assessment

Status: Still Draft — Awaiting Review & Rebase

Aspect	Status	Notes
Code Quality	✅ Pass	All local checks pass (ruff, mypy, pytest)
Security	✅ Pass	No hardcoded secrets; CodeQL setup correct
Mergeable	✅ Yes	But requires rebase (currently "behind" main)
Draft Mode	⚠️ Active	Must be moved to "ready for review"
Review	⏳ Pending	Waiting for @edson-esf review
Acceptance Criteria	✅ Met	All Issue #96 criteria addressed

Blockers to resolve:

1. Exit draft mode — Convert to ready for review
2. Rebase on main — Currently behind; needs update with latest main changes
3. Reviewer approval — Awaiting @edson-esf's review

---

The changes themselves are sound and ready — just need the administrative steps to move forward.

[oak-pokemon-lab]

TL;DR: GitHub is blocking the CodeQL upload because code scanning is disabled at the repository level. If your repository is private, CodeQL requires a paid GitHub Advanced Security license; if it is public, it is free, but you still need to enable it and set the correct workflow permissions.

• Option 1: Enable CodeQL (Best if the repo is Public or you have a paid license)
• Option 2: Change to Public Visibility (Free CodeQL)
• Option 3: Use Free Python Linters (Best if repo must stay Private)

[oak-pokemon-lab]

"A defeat is not the end; it is merely the beginning of a new journey toward strength." - Cynthia (Sinnoh Champion)