ci(codeql): add actions:read so the analyze step can finish; keep private-repo gate until code scanning is available

.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - "codex/**"
+  schedule:
+    - cron: "23 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  # `actions: read` is required: the codeql-action's final status/upload call
+  # reads the workflow run (REST get-a-workflow-run), and an explicit
+  # permissions block zeroes every scope not listed here. Without it the
+  # analyze step dies with "Resource not accessible by integration".
+  actions: read
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    # Gate stays until code scanning is available: this is a private
+    # personal-account repo without GitHub Advanced Security, so the SARIF
+    # upload rejects with "Code scanning is not enabled for this repository"
+    # and the analyze step fails red on every trigger (verified on PR #89,
+    # run 31508386840, after the actions:read fix above). Ungated, every PR
+    # and schedule run would fail and burn the shared VPS runner. Set the
+    # ENABLE_PRIVATE_CODEQL repo variable to '1' once GHAS/code scanning is
+    # provisioned (or when the repo goes public), and the permission fix
+    # above lets the run finish.
+    if: ${{ github.event.repository.private == false || vars.ENABLE_PRIVATE_CODEQL == '1' }}
+    name: analyze javascript-typescript
+    runs-on: [self-hosted, linux, x64, vps-verify]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          queries: security-and-quality
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:javascript-typescript"