ci: add CodeQL workflow

[nanotaboada]

Closes #77

Summary by CodeRabbit

• Chores

  • Added an automated security scanning workflow that runs on pushes, pull requests, and a weekly schedule to improve repository security checks.

• Documentation

  • Updated release notes and README to include the new security workflow and added a status badge reflecting its results.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2f883cbf-b661-4588-93e8-c4843a47446e

📥 Commits

Reviewing files that changed from the base of the PR and between c620f72 and fdb7e4f.

📒 Files selected for processing (3)

• .github/workflows/codeql.yml
• CHANGELOG.md
• README.md

✅ Files skipped from review due to trivial changes (3)

• README.md
• CHANGELOG.md
• .github/workflows/codeql.yml

---

Walkthrough

A new GitHub Actions workflow .github/workflows/codeql.yml is added to run CodeQL Advanced analysis on pushes and pull requests to master and on a weekly schedule. The workflow runs analyses for actions and rust languages (both with build-mode: none). README and CHANGELOG entries were added.

Changes

Cohort / File(s)	Summary
CodeQL Workflow Configuration ​.github/workflows/codeql.yml	New CodeQL Advanced workflow. Triggers: push & pull_request on master, and weekly cron. Matrix: actions, rust (both build-mode: none). Sets permissions and runs github/codeql-action/init@v4 + analyze@v4.
Documentation / Badge README.md	Added CodeQL Advanced workflow badge/link referencing .github/workflows/codeql.yml.
Changelog CHANGELOG.md	Added “CodeQL Advanced workflow” entry under Unreleased → Added referencing .github/workflows/codeql.yml.

Sequence Diagram(s)

(no diagrams generated)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Assessment against linked issues

Objective	Addressed	Explanation
CodeQL workflow file added with proper triggers (push, PR on master, weekly schedule) [#77]	✅
Languages matrix includes actions and rust [#77]	❓	rust is present but configured with build-mode: none instead of autobuild/manual suggested in the issue.
CodeQL badge added to README.md [#77]	✅
Permissions properly scoped (security-events: write, packages/actions/contents: read) [#77]	✅

Out-of-scope changes

Code Change	Explanation
None identified	All functional changes (workflow, README badge, changelog) relate to the linked issue objectives.

Possibly related issues

• [CI] Add CodeQL security scanning react-samples-tailwind-team#4 — Similar addition of a .github/workflows/codeql.yml workflow (different language matrix: javascript-typescript); potentially relevant for cross-repo consistency.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits format with 'ci:' prefix, is descriptive and specific about adding a CodeQL workflow, and is well under 80 characters (23 characters total).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/codeql-workflow

• 🛠️ sync documentation: Commit on current branch
• 🛠️ sync documentation: Create PR
• 🛠️ enforce http error handling: Commit on current branch
• 🛠️ enforce http error handling: Create PR
• 🛠️ idiomatic review: Commit on current branch
• 🛠️ idiomatic review: Create PR
• 🛠️ verify api contract: Commit on current branch
• 🛠️ verify api contract: Create PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.14%. Comparing base (b246cef) to head (fdb7e4f).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #80   +/-   ##
=======================================
  Coverage   84.14%   84.14%           
=======================================
  Files           6        6           
  Lines         164      164           
=======================================
  Hits          138      138           
  Misses         26       26           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.