Add explicit CodeQL workflow for Actions scanning

[Copilot]

GitHub’s managed Default setup was not reliably initializing Actions analysis for this repository. This change moves CodeQL to an explicit repository-owned workflow so the scan runs from a normal checkout and analyzes .github/workflows consistently.

• What changed

  • Added .github/workflows/codeql.yml to run CodeQL in Advanced setup mode.
  • Configured triggers for:
    • push to main
    • pull_request targeting main
    • weekly scheduled scan

• CodeQL configuration

  • Initializes CodeQL with:
    • languages: actions
    • build-mode: none
  • Runs github/codeql-action/analyze@v3 to publish results.

• Permissions

  • Limits workflow permissions to:
    • contents: read
    • security-events: write

• Repository hygiene

  • Removes the accidentally committed GitHub cookie export.
  • Ignores ghcookies.txt to avoid reintroducing local credential artifacts.

- uses: github/codeql-action/init@v3
  with:
    languages: actions
    build-mode: none

- uses: github/codeql-action/analyze@v3

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Adds a repository-owned CodeQL workflow to ensure GitHub Actions workflow files (.github/workflows/**) are consistently analyzed in this repo, and prevents reintroducing a locally generated cookie artifact.

Changes:

• Added an explicit CodeQL workflow (actions language, build-mode: none) triggered on push, pull_request (main), and a weekly schedule.
• Updated .gitignore to ignore ghcookies.txt to avoid committing credential artifacts.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.gitignore	Ignores ghcookies.txt to prevent committing local credential artifacts.
.github/workflows/codeql.yml	Adds an explicit CodeQL workflow to scan GitHub Actions workflows on main PRs/pushes and on a schedule.

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 91.0%

📦 Project: mssql-tds ℹ️ Note: diff coverage is reported, not enforced.

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

🔗 Quick Links

View Azure DevOps Build · Coverage Report