chore: add CodeQL workflow and pin actions to commit SHAs (#3)

Adds .github/workflows/codeql.yml running CodeQL static analysis on
push, pull_request, and a weekly schedule (Sun 00:00). Targets the
javascript-typescript language pack since the spec ships with TS
generation tooling.

Pins every third-party action invocation (actions/checkout,
actions/setup-node, github/codeql-action/*) to a full commit SHA with
the corresponding semver tag in a trailing comment. Pinning to SHA
closes the supply-chain hole where a compromised or rewritten tag
could ship malicious code into CI.

Adds a least-privilege top-level `permissions: contents: read` block
to the existing validate workflow.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: sansware

.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c35d1b164463ee62a100735382aaaa525c5d3496 # codeql-bundle-v2.25.6
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c35d1b164463ee62a100735382aaaa525c5d3496 # codeql-bundle-v2.25.6
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/validate.yml

@@ -11,17 +11,20 @@ on:
       - "openapi.yaml"
       - ".github/workflows/validate.yml"
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Lint + validate openapi.yaml
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"