Add CodeQL Analysis workflow for automated security scanning

[Copilot]

This PR adds a CodeQL Analysis workflow to enhance code security and automatically identify vulnerabilities in the repository. The workflow follows GitHub's recommended security practices for continuous code analysis.

What's Added

• .github/workflows/codeql.yml - A comprehensive CodeQL workflow configuration

Key Features

• Language Support: Configured for JavaScript/TypeScript analysis, covering the primary runtime languages used across all gateway and verifier packages
• Comprehensive Triggers:
  • Runs on every push to the main branch
  • Analyzes pull requests targeting main before merge
  • Includes weekly scheduled scans (Mondays at 17:24 UTC) for continuous monitoring
• Security-First Configuration: Proper permissions for security-events, packages, actions, and contents
• Production Ready: Uses latest CodeQL actions (v4/v3) with 360-minute timeout and fail-fast disabled for complete analysis

Implementation Details

The workflow uses GitHub's standard CodeQL template with customizations for this monorepo structure:

- Language: javascript-typescript
- Build Mode: none (no compilation required)  
- Runner: ubuntu-latest
- Strategy: Matrix-based analysis with comprehensive coverage

Benefits

1. Automated Security Scanning: Identifies potential security vulnerabilities in TypeScript/JavaScript code
2. PR Integration: Security analysis runs before code is merged to main
3. Continuous Monitoring: Weekly scans catch newly discovered vulnerability patterns
4. Zero Maintenance: Fully automated with no impact on existing CI workflows

Repository Analysis

The workflow targets JavaScript/TypeScript files which represent the core operational code:

• 11,788+ TypeScript files
• 27,498+ JavaScript files
• Gateway services, build scripts, and runtime logic

While the repository also contains 2,062 Solidity smart contract files, CodeQL doesn't currently support Solidity analysis. The JavaScript/TypeScript focus provides comprehensive security coverage for all runtime and operational code.

The workflow will begin running immediately upon merge and will populate the repository's Security tab with any findings.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/dapphub/ds-test/tarball/
  • Triggering command: bun install --ignore-scripts (http block)
• https://api.github.com/repos/ethereumjs/ethereumjs-abi/tarball/
  • Triggering command: REDACTED, pid is -1 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

This pull request was created as a result of the following prompt from Copilot chat.

Add a CodeQL Analysis workflow to this repository to enhance code security and identify vulnerabilities. Use the standard CodeQL workflow template provided by GitHub and target the primary programming languages used in this repository. Ensure the workflow runs on pull requests and pushes to the default branch.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR adds a CodeQL security analysis workflow to enable automated vulnerability scanning of the JavaScript/TypeScript codebase. The workflow is configured to run on pushes to main, pull requests targeting main, and on a weekly schedule.

Changes:

• Added .github/workflows/codeql.yml with CodeQL analysis configuration for JavaScript/TypeScript
• Configured workflow triggers for push, pull requests, and scheduled scans (weekly on Mondays)
• Set up proper permissions for security scanning with appropriate timeout and fail-fast settings

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.