Extend CodeQL to the actions language, settle on security-extended, and document the alert dismissal policy (#341)

[Kshot3000]

What this does

Follow-up to #298 / #335, closing out #341 in one change:

1. The actions language is analysed. One matrix entry (build-mode: none) alongside javascript-typescript. The Actions extractor reads the workflow YAML directly, and the run on my fork analyses this repo's workflows cleanly with no extra configuration: 17 rules (default suite), 0 results. These are the highest-privilege files in the repo — deploy.yml holds pages: write and id-token: write — and until now nothing scanned them.

2. The query suite is settled: security-extended. Comparison run on a throwaway fork branch, both suites against this tree:

Suite	javascript-typescript	actions	Results
default	87 rules	17 rules	0
security-extended	103 rules	23 rules	0

The wider suite surfaces nothing extra on the current code, so the noise risk #341 flags does not materialise — the extra 22 rules are free coverage, and the suite is now a decision instead of a default. (The numbers are also recorded on #341 itself.)

3. TRIAGE.md states the dismissal policy. Only a maintainer may dismiss a code scanning alert, and only with one of the three GitHub reason codes — false positive, won't fix, used in tests — each with what the dismissal comment must show; dismissing for convenience or without an explanation is explicitly not acceptable, and dismissals are revisited in the monthly review. The Security scanning section also now records that workflows are covered.

Verification

• Both fork probe runs are green (default suite + actions, and security-extended + actions), and the per-language rule/result counts above come from the code-scanning analyses those runs uploaded.
• The workflow YAML parses; the only changes are the matrix entry, the queries: line, and comments.
• Files changed: exactly .github/workflows/codeql.yml and TRIAGE.md.

---

Built and maintained by me, an independent Cardano community builder — not affiliated with the Cardano Foundation, IOG or Intersect.
@Kshot9000 (https://x.com/kshot9000) · ADA: addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v
cc @cardano-foundation @IntersectMBO

[IanoNjuguna]

hey, gonna review this before merging

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.