[AndreyVMarkelov]

Summary

• add weekly, push, pull-request, and manual CodeQL scans for C# and GitHub Actions
• set least-privilege default permissions across existing workflows while preserving job-level OIDC and deployment permissions
• move release tags and generated values through environment variables and $GITHUB_OUTPUT instead of direct expression interpolation and deprecated set-output commands
• use CodeQL Action v4 for the current Node 24 runtime

Why

Several workflows relied on implicit token permissions, deprecated output syntax, or direct GitHub expression interpolation inside shell scripts. These changes make permissions explicit, reduce shell-injection risk, modernize workflow outputs, and add security scanning.

Impact

CI, documentation publishing, NuGet publishing, and automated spec updates retain their existing triggers and behavior. CodeQL adds security analysis for C# sources and workflow files.

Validation

• actionlint .github/workflows/codeql.yml
• git diff --check
• reviewed all changed workflow permissions and shell interpolation paths

Full-repository actionlint still reports the pre-existing unsupported concurrency.queue key in ci.yml and an unchanged shell style warning in spec_update.yml.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.36%. Comparing base (1f4b0c2) to head (8cab961).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #397   +/-   ##
=======================================
  Coverage   61.36%   61.36%           
=======================================
  Files          17       17           
  Lines        1654     1654           
  Branches      155      155           
=======================================
  Hits         1015     1015           
  Misses        565      565           
  Partials       74       74           

Flag	Coverage Δ
integration	56.95% <ø> (ø)
unit	33.79% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.