Add codeql yml file

[mzielu]

Why

This repo had no security code scanning. It had GitHub Code Quality, which runs as a dynamic workflow—no Gradle caching and not re-runnable.

On #106, the Gradle wrapper download timed out, and with the code_quality ruleset rule gating merges, the only escape was:

git commit --allow-empty

That blocking issue has already been fixed by a settings change (described below). This PR adds the missing security scanning as a real workflow file so it's cached and re-runnable.

What changed

Adds .github/workflows/codeql.yml — CodeQL advanced setup for java-kotlin.

Triggers:

• Push to master
• Pull requests targeting master
• Weekly scheduled run
• Manual dispatch

Key configuration:

• build-mode: manual — Kotlin can't be analyzed buildless.
• --no-build-cache --no-configuration-cache are load-bearing. CodeQL builds its database by tracing the compiler. Since gradle.properties enables both caches, a cached compileKotlin would produce an empty database—a green check that analyzed nothing.
• setup-gradle@v4 caches the Gradle distribution and adds a 3× retry for cold starts (addressing the chore(deps): bump jvm from 2.4.0 to 2.4.10 #106 failure).
• queries: security-extended — free on public repositories, with roughly 30–60% longer analysis time.

Verified on this PR:

• ✅ Green in ~2 minutes.
• ✅ Code scanning results / CodeQL reports no new alerts.

Settings changed outside this diff

• Removed the code_quality ruleset rule — this was what allowed flaky runs to block merges. Quality findings no longer gate pull requests; GitHub only provides that gate through the non-rerunnable workflow.
• Disabled Code Quality analysis to avoid compiling the project twice. This is reversible—re-enabling it restores quality findings as informational results.

Follow-ups

• Fold code-quality into the workflow once analysis-kinds is no longer [Internal].
• Add package-ecosystem: github-actions to dependabot.yml (currently Gradle only).

---

Unblocks #106.

[github-actions]

Coverage Report

Overall Project	96.85%	🍏

There is no coverage information present for the Files changed

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[mfabisiak]

LGTM!