ci: set up codeql static analysis workflow

[google-labs-jules]

Summary

This PR adds a CodeQL static analysis workflow to the CI pipeline. This will enable automatic security vulnerability detection and satisfy the branch protection requirements for code scanning results on the main branch.

Changes

• Created .github/workflows/codeql.yml with standard Python configuration.
• Configured triggers for push and pull requests to main.
• pinned actions to full commit SHAs for enhanced security.
• Included a weekly scheduled scan.

Checklist

• ruff check . passes
• ruff format --check . passes
• PYTHONPATH=src mypy src/app/ passes
• pytest passes
• No hardcoded secrets
• Commit messages follow the standard

Closes

Closes #99

Related

Related to #97, #98

Reviewers

🤖 Bot reviewers: please tag @jules in your feedback so I can act on it.

Fixes #96

---

PR created automatically by Jules for task 2312544910388613847 started by @edsonesf

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[edsonesf]

@jules the Code Quality tests are failing.
Investigate the CI issues.

CodeQL is returning:

Resource not accessible by integration - https://docs.github.com/rest/actions/workflow-runs#get-a-workflow-run

[edsonesf]

🔍 CodeQL CI Investigation & Findings

We have conducted a thorough investigation into why the CodeQL workflow is failing with the Resource not accessible by integration error.

1. Token Permissions Issue (Resolved)

Initially, the workflow failed because PRs created by automated bots (like google-labs-jules[bot]) are granted a strictly read-only GITHUB_TOKEN. This prevents the github/codeql-action from interacting with the GitHub REST API and uploading SARIF security results.
Fix applied: We refactored .github/workflows/codeql.yml by applying the Principle of Least Privilege (moving the permissions: block to the job level) and triggered a new workflow run via a human-context commit, which successfully bypassed the bot token restriction.

2. Advanced Security Licensing (Root Cause)

Although the token permissions were corrected, the SARIF upload still failed with a new error:

Error: Code scanning is not enabled for this repository.

We attempted to programmatically enable Code Scanning for this repository via the GitHub API/CLI, which yielded the following exact output:

gh repo view --json isPrivate,visibility

{
  "isPrivate": true,
  "visibility": "PRIVATE"
}

gh api -X PATCH /repos/edsonesf/ATU-CSD-POKEDEX -f 'security_and_analysis[advanced_security][status]=enabled'

{
  "message": "Advanced security has not been purchased.",
  "documentation_url": "https://docs.github.com/rest/repos/repos#update-a-repository",
  "status": "422"
}
gh: Advanced security has not been purchased. (HTTP 422)

Conclusion:
Code Scanning (CodeQL) is 100% free and enabled by default for Public repositories, but it strictly requires a paid GitHub Advanced Security (GHAS) license for Private repositories. Because edsonesf/ATU-CSD-POKEDEX is currently a Private repository and does not have an attached GHAS license, CodeQL is blocked and the UI options are hidden.

• The repository is currently set to Private
• I already have Github Student Pro package via ATU

Alternatives to consider:

1. Make the repository Public: If it is safe and permissible for this academic project, changing the visibility to Public will instantly unlock CodeQL for free.
2. Rely on Semgrep: The repository already has .github/workflows/semgrep.yml successfully configured and running. Semgrep is an excellent SAST alternative that works for free on private repositories. We recommend closing this PR and relying entirely on Semgrep unless CodeQL is a strict academic requirement.
3. Install and run CodeQL in my local developemnt host

[edsonesf]

Status Update: Due to the GitHub Advanced Security licensing requirements for Private repositories, the automated CodeQL integration via GitHub Actions is not possible at this time.

We will defer this PR for now and continue relying on the existing semgrep.yml workflow for our automated SAST checks. A local CodeQL installation guide has been documented in the repository (.agents/issues/237/codeql.md) for performing manual analysis when needed.

[oak-pokemon-lab]

"You're going to run into many tough opponents... always catch the strongest Pokémon. That's part of being the very best." Professor Oak