feat(ci): add CodeQL static analysis workflow (#298)

[Kshot3000]

Closes #298

What this adds

Dependabot already covers dependency alerts here, but nothing scans the code itself. This adds the CodeQL workflow #298 proposes, so static analysis covers the website's JavaScript/TypeScript alongside it.

.github/workflows/codeql.yml:

• Analyses javascript-typescript with build-mode: none — CodeQL extracts JS/TS directly from source, so no build step is needed and the Docusaurus site in website/ is covered as-is.
• Runs on push to main, on pull requests targeting main, and weekly on a schedule (Mondays 06:30 UTC), matching the proposal.
• Uses the current action majors — actions/checkout@v6, as the existing workflows here do, and github/codeql-action@v4 (init + analyze).
• Least-privilege permissions: contents: read at the top level; the analyze job adds only what uploading results requires (security-events: write, plus packages: read / actions: read per the CodeQL template).

TRIAGE.md gains a short "Security scanning" section, per the issue's third acceptance item: Dependabot and CodeQL, where each one's results appear (Security → Dependabot / Security → Code scanning), and a note that Security-labelled items are exempt from stale automation, so an alert stays visible until a maintainer closes it.

Verification

• The workflow parses cleanly and passes actionlint (v1.7.7) with no findings; the rest of the repo's workflows pass it too, unchanged.
• The two remaining acceptance items — the workflow running green on main and alerts appearing under Security → Code scanning — can only be confirmed after this merges, since code scanning results publish from the default branch. The first scheduled or push run will populate the tab; if the default query suite turns out noisy, the suite can be tuned then, as the issue suggests.

---

Independent builder — not affiliated with the Cardano Foundation, IOG or Intersect.

— Kyle Cox, @Kshot9000 (https://x.com/kshot9000)

Tips: ADA addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

[IanoNjuguna]

Hey Kyle, welcome to life as a contributor for the DevEx repo. I'm looking at the updates you shipped before merging this request. In the meanwhile, you should pick another issue and work on it.

For instance, we're redesigning the landing page and there is a call for references we can use as inspiration. Your feedback on this is encouraged. The call is on #300

[Kshot3000]

Thanks for the welcome, and for taking a look before merging. The two acceptance items that can only happen after merge (first green run on main, alerts surfacing under Security → Code scanning) are noted in the PR body — happy to follow up if anything looks off there.

I've added feedback on #300 as invited: a measured gap in the current token set (the repeated raw hex values are almost all neutrals with no ramp to point at) plus a short reference list picked for the token-publishing model rather than the visuals.

— Kyle Cox (@Kshot9000, https://x.com/kshot9000) · Independent builder — not affiliated with the Cardano Foundation, IOG or Intersect.
ADA: addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

[Kshot3000]

Sounds good ill take a look

…

On Fri, Oct 16, 2026, 5:03 AM Ian Njuguna ***@***.***> wrote: *IanoNjuguna* left a comment (IntersectMBO/developer-experience#335) <#335 (comment)> Hey Kyle, welcome to life as a contributor for the DevEx repo. I'm looking at the updates you shipped before merging this request. In the meanwhile, you should pick another issue and work on it. For instance, we're redesigning the landing page and there is a call for references we can use as inspiration. Your feedback on this is encouraged. The call is on #300 <#300> — Reply to this email directly, view it on GitHub <#335?email_source=notifications&email_token=CMAPYQCJQQV35FQJ3GK32PD5UHXABA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMRRGMYDMMZWGUZ2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6213063653>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CMAPYQCGPHL4MGKUL6XWMPL5UHXABAVCNFSNUABFKJSXA33TNF2G64TZHM4TANBYGUZDOOJWHNEXG43VMU5TKOBXG42DEOBRGE22C5QC> . You are receiving this because you authored the thread.Message ID: ***@***.***>