[samdev-7]

CodeQL never ran on pull requests from forks, so three required checks never reported on them.

The problem

• The repository uses CodeQL default setup, which only ran for main and for pull requests from branches in this repository.
• Branch protection on main requires Analyze (actions), Analyze (javascript-typescript) and Analyze (ruby).
• On every fork pull request these checks stayed at "Expected — waiting for status", so the pull request could only merge with an admin bypass. This affected Prefill Hack Club Auth with the preferred name, and accept it on the invite API #210, Add an "All Attendees + Held Invitations" message audience #215, Keep invites with a 19+ birthday, and hold them at onboarding until staff correct it #216, Make admin confirmations actually ask before acting #220, and Let staff send an already-sent message to people who joined its audience since #219 (open).
• Same-repository pull requests get 14 checks. Fork pull requests get 10, missing the three Analyze jobs and the CodeQL result check.

The change

Adds .github/workflows/codeql.yml, a CodeQL advanced-setup workflow. It keeps what default setup was doing:

• Languages: actions, javascript-typescript and ruby, with build-mode: none. These are the same as default setup, taken from its run logs.
• Categories: /language:<language>, the same as default setup, so existing alerts carry over.
• Job names: Analyze (<language>), so they still match the required checks.
• Triggers:
  • pull requests to main, including from forks;
  • pushes to main;
  • a weekly schedule.

actionlint passes on all six workflows. Brakeman's SARIF upload already works from fork pull requests here (the Brakeman check shows up on #219), so CodeQL's upload should work the same way. Step 5 below confirms that.

Rollout (order matters)

GitHub rejects advanced-setup results while default setup is turned on, so this pull request's own CodeQL jobs will fail until step 2.

1. Review this pull request.
2. A repository admin turns off CodeQL default setup: Settings → Code security → Code scanning → CodeQL analysis → ⋯ → Disable CodeQL. Don't delete the existing alerts.
3. Re-run the failed CodeQL jobs on this pull request and confirm all three Analyze checks pass.
4. Merge.
5. Confirm on a fork pull request: push to Let staff send an already-sent message to people who joined its audience since #219, or close and reopen it, and check that all three Analyze checks run and pass.

While steps 2–4 are in progress, other open pull requests won't get CodeQL results. Re-run or push to them after merging.

Not changed

• brakeman.yml sets continue-on-error: true, so the required Brakeman Scan check can't fail. Brakeman still blocks merges through CI's scan_ruby.
• Brakeman and RuboCop each run twice: once in their own workflows and again in ci.yml.