Add CodeQL Analysis workflow for enhanced code security scanning

[Copilot]

This PR adds a CodeQL Analysis workflow to enhance code security and automatically identify vulnerabilities in the repository. The workflow follows GitHub's standard CodeQL template and is configured to analyze the primary programming languages used in this codebase.

Changes Made

• Added .github/workflows/codeql.yml - New CodeQL Analysis workflow
• Language Support: Configured to analyze JavaScript/TypeScript (the primary languages with 83+ source files)
• Trigger Conditions:
  • Runs on pushes to the main branch
  • Runs on pull requests targeting the main branch
  • Includes weekly scheduled scans (Mondays at 14:22 UTC)

Workflow Features

• Uses latest GitHub Actions versions (checkout@v4, codeql-action@v3)
• Proper security permissions for code scanning results
• Optimized build mode (none) for JavaScript/TypeScript analysis
• Comprehensive timeout handling (360 minutes for thorough analysis)
• Compatible with existing CI/CD pipeline

Solidity Smart Contracts

While this repository contains Solidity smart contracts in various verifier directories, CodeQL does not currently support Solidity analysis. The workflow includes documentation suggesting specialized tools like Slither or Mythril for smart contract security analysis.

Security Benefits

This workflow will automatically:

• Scan code for common security vulnerabilities
• Identify potential code quality issues
• Provide security alerts through GitHub's Security tab
• Generate SARIF results for detailed vulnerability reporting
• Run continuously on all new code changes

The CodeQL Analysis workflow enhances the repository's security posture by providing automated, continuous security scanning alongside the existing build and test workflows.

This pull request was created as a result of the following prompt from Copilot chat.

Add a CodeQL Analysis workflow to this repository to enhance code security and identify vulnerabilities. Use the standard CodeQL workflow template provided by GitHub and target the primary programming languages used in this repository. Ensure the workflow runs on pull requests and pushes to the default branch.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.