ci: add orig CodeQA config to switch to advanced mode

[tianjianjiang]

• duplicate ci: add path filters to Xcode and CodeQL workflows #713: The requirement and its description below are conceptually merged into ci: add path filters to Xcode and CodeQL workflows #713
• blocks: ci: add Python data tools workflow #714
• blocks: Update CI workflow to package and upload artifact #715

Both CodeQL workflow failures (cpp and swift) are caused by the same configuration conflict:

• Root cause: CodeQL Default Setup is enabled in the GitHub repository settings
• Error: "CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled"

This cannot be fixed via workflow file changes. You need to:

1. Go to GitHub repository settings: https://github.com/openvanilla/McBopomofo/settings/security_analysis
2. Find "CodeQL Default Setup" section
3. Disable it (switch from "Default" to "Advanced")

Once disabled, the existing .github/workflows/codeql.yml workflow will work correctly.

[Copilot]

Pull Request Overview

This PR adds a CodeQL Advanced workflow configuration to enable advanced security scanning for the repository. The workflow implements a multi-language scanning strategy targeting the project's diverse codebase.

Key changes:

• Introduces CodeQL Advanced workflow with support for 5 languages (actions, c-cpp, python, ruby, swift)
• Configures automated and scheduled scanning on push, pull requests, and weekly schedule
• Sets up appropriate build modes (autobuild for compiled languages, none for interpreted languages)

[Copilot]

Remove emoji from comments. According to project guidelines, emoji are prohibited in all code, comments, and documentation outside of Source/Data/.

[claude]

PR Review: CodeQL Advanced Configuration

This PR adds a new GitHub Actions workflow for CodeQL Advanced security scanning. No critical bugs, security vulnerabilities, or correctness issues found.

Minor observations:

• The workflow analyzes 5 languages (actions, c-cpp, python, ruby, swift) but based on AGENTS.md, this project primarily uses Swift, Objective-C++, and C++. Python is used for dictionary data generation, but ruby and actions analysis may not be necessary unless there's Ruby code or complex GitHub Actions workflows in the repo. This could increase CI time unnecessarily but doesn't impact functionality.
• The workflow uses autobuild for c-cpp and swift, which should work for this Xcode project based on the documentation.
• The manual build mode error handling at lines 92-100 is properly configured to fail if manual build is set without implementation.

APPROVED

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Matrix Coverage The language matrix omits 'javascript-typescript', 'go', 'java-kotlin', 'csharp', and 'rust'. If the repo contains any of these, they won't be scanned. Confirm the selected languages match the codebase to avoid blind spots. include: - language: actions build-mode: none - language: c-cpp build-mode: autobuild - language: python build-mode: none - language: ruby build-mode: none - language: swift build-mode: autobuild # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' # Use `c-cpp` to analyze code written in C, C++ or both # Use 'java-kotlin' to analyze code written in Java, Kotlin or both # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages Manual Build Step The manual build path always exits 1, which will fail the job if any language is switched to 'manual'. Ensure real build commands are added before enabling manual mode, or guard this step further to avoid unintended failures. - name: Run manual build steps if: matrix.build-mode == 'manual' shell: bash run: | echo 'If you are using a "manual" build mode for one or more of the' \ 'languages you are analyzing, replace this with the commands to build' \ 'your code, for example:' echo ' make bootstrap' echo ' make release' exit 1 Branch Filtering Triggers are limited to 'master'. If the default branch differs (e.g., 'main') or feature branches are used, scans may be skipped. Validate branch names align with repository conventions. push: branches: [ "master" ] pull_request: branches: [ "master" ] schedule: - cron: '36 7 * * 0'

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Use explicit conditional runner selection The boolean short-circuit trick can yield a non-string (falsey) value and break runner resolution if the expression is mis-evaluated. Use an explicit conditional to reliably select the runner OS. .github/workflows/codeql.yml [30] -runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} +runs-on: ${{ matrix.language == 'swift' ? 'macos-latest' : 'ubuntu-latest' }} Suggestion importance[1-10]: 8 __ Why: Replacing the boolean short-circuit with a ternary in GitHub Actions expressions improves correctness and readability; the current pattern is brittle and less idiomatic.	Medium
General	Avoid unconditional manual build failure Failing the job unconditionally when build-mode is manual will break all matrix entries set to manual. Replace the placeholder with a no-op and a clear message to avoid accidental failures until real build steps are added. .github/workflows/codeql.yml [94-102] - name: Run manual build steps if: matrix.build-mode == 'manual' shell: bash run: | - echo 'If you are using a "manual" build mode for one or more of the' \ - 'languages you are analyzing, replace this with the commands to build' \ - 'your code, for example:' - echo ' make bootstrap' - echo ' make release' - exit 1 + echo "Manual build mode selected for '${{ matrix.language }}' but no build steps are configured." + echo "Add build commands here to compile your project." + exit 0 Suggestion importance[1-10]: 6 __ Why: Preventing unconditional failure reduces accidental breakage for manual builds, though it trades off surfacing missing build steps; impact is moderate and context-dependent.	Low
	Clarify schedule timezone intent Scheduled workflows in private forks or when disabled by default may not run as expected; also, Sunday 07:36 UTC may be unintended. Clarify intent by documenting timezone and optionally narrow schedules to reduce unnecessary runs. .github/workflows/codeql.yml [20-21] schedule: + # Runs every Sunday at 07:36 UTC; adjust if your team operates in a different timezone. - cron: '36 7 * * 0' Suggestion importance[1-10]: 3 __ Why: Adding a comment about UTC timing can reduce confusion but is non-functional; it's a minor clarity improvement with limited impact.	Low