feat(security): add CodeQL analysis and pre-release version gate#208

Open

bedatty wants to merge 7 commits intodevelopfrom

feat/pr-security-scan-codeql-prerelease

Commits on Apr 9, 2026

feat(security): add CodeQL analysis and pre-release version gate to PR security scan
bedatty
committed
fix(security): configure private Go module access for CodeQL autobuild
bedatty
committed
fix(security): add actions:read permission for CodeQL status reporting
bedatty
committed
fix(security): disable SARIF upload by default in codeql-analyze composite
bedatty
committed
feat(security): add codeql_upload_sarif input for Security tab integration
bedatty
committed
feat(security): make prerelease gate branch-aware (block on rc/main, warn on develop)
bedatty
committed
feat(security): broaden prerelease check to block all unstable version suffixes
bedatty
committed