CI: add CodeQL workflow and harden Actions workflows

- Add codeql.yml scanning actions + python on push/PR/weekly
- spec_update.yml: migrate ::set-output to $GITHUB_OUTPUT; pass
  interpolated values via env: to avoid shell injection
- pypiupload.yml: add least-privilege top-level permissions

Author: AndreyVMarkelov

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: 0 0 * * 1
+
+permissions:  # least privilege
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # required to upload CodeQL results
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["actions", "python"]
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/pypiupload.yml

@@ -8,6 +8,9 @@ on:
     types: [created]
   workflow_dispatch:  # Allow manual trigger for testing
 
+permissions:  # least privilege; the deploy job overrides this for OIDC
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/spec_update.yml

@@ -28,25 +28,29 @@ jobs:
           git submodule update --remote --recursive
       - name: Generate Branch Name
         id: git-branch
+        env:
+          FORMATTED_TIME: ${{ steps.current-time.outputs.formattedTime }}
         run: |
-          echo "::set-output name=branch::spec_update_${{ steps.current-time.outputs.formattedTime }}"
+          echo "branch=spec_update_${FORMATTED_TIME}" >> "$GITHUB_OUTPUT"
       - name: Generate Num Diffs
         id: git-diff-num
         run: |
           diffs=$(git diff --submodule spec | grep ">" | wc -l)
           echo "Number of Spec diffs: $diffs"
-          echo "::set-output name=num-diff::$diffs"
+          echo "num-diff=$diffs" >> "$GITHUB_OUTPUT"
       - name: Generate Diff
         id: git-diff
+        env:
+          NUM_DIFF: ${{ steps.git-diff-num.outputs.num-diff }}
         run: |
           cd spec
-          gitdiff=$(git log -n ${{ steps.git-diff-num.outputs.num-diff }} --pretty="format:%n %H %n%n %b")
+          gitdiff=$(git log -n "$NUM_DIFF" --pretty="format:%n %H %n%n %b")
           commit="Automated Spec Update $gitdiff"
-          commit="${commit//'%'/'%25'}"
-          commit="${commit//$'\n'/'%0A'}"
-          commit="${commit//$'\r'/'%0D'}"
-          echo "Commit Message: $commit"
-          echo "::set-output name=commit::$commit"
+          {
+            echo "commit<<SPEC_UPDATE_EOF"
+            echo "$commit"
+            echo "SPEC_UPDATE_EOF"
+          } >> "$GITHUB_OUTPUT"
           cd ..
       - name: Generate New Routes
         run: |