sanitizeForLog() already strips CR, LF, and control characters from user
input before logging, but CodeQL did not recognize the custom sanitizer.
This caused false-positive log-injection alerts at every call site.
Add a CodeQL data extension model that marks the return value of
sanitizeForLog() as a barrier against log-injection taint, and a
codeql-config.yml that references it.
* ci: add CodeQL analysis and Docker ecosystem to Dependabot
Add CodeQL workflow running javascript-typescript analysis weekly and on
every PR/push to main, using the security-extended query suite. All three
codeql-action steps are SHA-pinned.
Add the docker package-ecosystem to dependabot.yml so Dependabot opens
weekly PRs to bump Dockerfile digest pins (FROM node:22-alpine@sha256:...
and the golang builder stage) when upstream images are updated.
* ci(codeql): upgrade codeql-action to v3.35.2
v3.29.0 uses Node.js 20, which is deprecated on GitHub-hosted runners as
of April 2026, causing SARIF upload failures with "Resource not accessible
by integration." v3.35.2 runs on Node.js 24 and resolves the deprecation.
* ci(codeql): add actions:read permission for workflow run API
CodeQL v3.35.2 calls the GitHub Actions REST API to fetch workflow run
context for SARIF correlation, which requires actions:read. Without it,
the analyze step fails with "Resource not accessible by integration"
when calling /repos/{owner}/{repo}/actions/runs/{run_id}.
dependabot[bot]