ci: add the configuration for codeql

[Yuyu-1115]

Summary by CodeRabbit

• Chores
  • Added automated CodeQL analysis for Kotlin and Swift code.
  • Checks run when changes are pushed or proposed for the main branch.
  • Scheduled weekly scans and manual runs are also supported.
  • Separate analysis jobs configure the required build and scanning steps for each supported language.
  • Concurrent runs are managed to reduce redundant workflow activity.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c2577b5b-8b81-4d34-aa32-8e3c169c43e2

📥 Commits

Reviewing files that changed from the base of the PR and between 76c3a0b and b35c21c.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/codeql.yml

---

📝 Walkthrough

Walkthrough

Added a GitHub Actions CodeQL workflow for Kotlin and Swift. The workflow runs on pushes and pull requests to main, weekly, or by manual dispatch. It configures permissions, concurrency, builds, and analysis uploads.

Changes

CodeQL analysis

Layer / File(s)	Summary
Workflow triggers and execution controls .github/workflows/codeql.yml	The workflow runs on changes to main, on a weekly schedule, and through manual dispatch. It sets required permissions and cancels superseded runs.
Kotlin and Swift CodeQL jobs .github/workflows/codeql.yml	Separate jobs configure Java, Gradle, macOS, and CodeQL. Each job builds its target and uploads analysis results.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to b35c2

This PR adds the repository’s CodeQL workflow configuration without any identified correctness, security, availability, or deployment risk; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of the CodeQL CI configuration, which is the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/codeql

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76c3a0ba6f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Disable Gradle caching during traced compilation

When setup-gradle restores a cached compileDebugKotlin result, this command can skip the Kotlin compiler entirely because gradle.properties enables the build cache. Gradle's --help confirms that the build cache reuses outputs from previous builds; since CodeQL was initialized only for this run, such a cache hit leaves the database without the traced Kotlin sources and can make analysis fail or be incomplete. Run this build with --no-build-cache (and preferably a clean output tree) so compilation always occurs after CodeQL initialization.

Useful? React with 👍 / 👎.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.