ci: run CodeQL on pull requests

[mesutoezdil]

/kind cleanup
CodeQL only runs on push to master and dev and on the weekly cron, so a finding is first seen after merge. #2190 is an example: the conversion it fixes has been open as alert #1031 since May. This adds the same trigger for pull requests targeting those branches, reusing the existing paths-ignore list. It also closes Scorecard alert #1149 (SAST), which checks whether a SAST tool runs on pull requests.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CodeQL workflow now runs for pull requests targeting master or dev, except when changes are limited to JSON, Markdown, text, or YAML files.

Changes

CodeQL workflow triggers

Layer / File(s)	Summary
Filtered pull request trigger .github/workflows/codeql-analysis.yml	Adds pull request triggering for master and dev, ignoring changes limited to **/*.json, **/*.md, **/*.txt, or **/*.yml.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested labels: enhancement

Suggested reviewers: spencercjh

Poem

I’m a bunny by the workflow gate,
Watching pull requests arrive in state.
Master and dev hop into view,
While docs and config files pass through.
CodeQL now springs to run—
A tidy check for everyone!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: enabling CodeQL analysis on pull requests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unittests	62.83% <ø> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[archlitchi]

/lgtm

[hami-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: archlitchi, mesutoezdil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [archlitchi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment