From ad3c161cf730c4da018b906cd5655a79ece4a690 Mon Sep 17 00:00:00 2001
From: Craig <3979063+craig8@users.noreply.github.com>
Date: Fri, 17 Jul 2026 20:03:37 -0700
Subject: [PATCH] ci: add CodeQL advanced setup to scan main and develop

Switches from GitHub default setup to an advanced setup workflow so that
CodeQL also scans the develop branch. Default setup cannot be configured
to watch a second branch (GitHub returns 422 when an extra branch is
requested via the API). The committed workflow covers the same scope that
default setup provided (languages: actions, python; query suite: default;
weekly schedule on Monday 02:00 UTC) and extends it to push and pull
requests targeting both main and develop.

autobuild is omitted: Python and actions (YAML) are interpreted or
declarative languages that do not require a compilation step. CodeQL
indexes them directly.

Action versions: actions/checkout@v4 (matches existing repo workflows),
github/codeql-action@v4 (current stable major; v3 is a maintenance track).

Note: GitHub enforces mutual exclusivity between default setup and
advanced setup. Merging this workflow to the default branch (main) and
letting it run will disable default setup automatically. A reviewer
should treat this PR as a full replacement, not an addition.

GOSS-GridAPPS-D is intentionally left on default setup as authorized.
---
 .github/workflows/codeql.yml | 38 ++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..0cc4583
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,38 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    # Weekly on Monday at 02:00 UTC, matching the previous default-setup cadence.
+    - cron: '0 2 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, python]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: default
+
+      # autobuild is omitted: both 'python' and 'actions' are interpreted or
+      # declarative languages that require no compilation step; CodeQL indexes
+      # them directly without a build.
+
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"