Add foundational GitHub Actions workflows for CI, CodeQL analysis, and dependency review

[Copilot]

This PR adds three foundational GitHub Actions workflows to enable Branch Protection with required status checks for the main branch. These workflows provide essential CI infrastructure while being designed to work safely even with minimal project setup.

Workflows Added

1. CI Workflow (.github/workflows/ci.yml)

• Matrix testing against Node.js versions 20 and 22
• Smart package detection - safely checks for package.json existence and skips CI steps if not found
• Conditional execution of install, lint, test, and security audit steps using --if-present flags
• Least-privilege permissions with only contents: read
• Status checks produced:
  • CI / build-and-test (Node 20)
  • CI / build-and-test (Node 22)

2. CodeQL Static Analysis (.github/workflows/codeql.yml)

• JavaScript security analysis using GitHub's CodeQL engine
• Multiple triggers: push/PR to main + weekly schedule (Mondays 06:00 UTC)
• Proper permissions for security events and actions
• Status check produced: CodeQL / Analyze (JavaScript)

3. Dependency Review (.github/workflows/dependency-review.yml)

• Vulnerability scanning for pull requests to main
• High-severity failure threshold to catch critical security issues
• Status check produced: Dependency Review / dependency-review

Design Features

All workflows are crafted to:

• ✅ Work even if no package.json exists at the root level (CI steps are skipped safely)
• ✅ Use least-privilege permissions following security best practices
• ✅ Produce predictable status check names for Branch Protection configuration
• ✅ Test against current LTS Node.js versions (20, 22)

Next Steps

After merging this PR:

1. Create a test PR to main to trigger all workflows and make status checks available in the repository
2. Configure Branch Protection in Settings → Branches for the main branch:
   • Enable "Require status checks to pass before merging"
   • Enable "Require branches to be up to date before merging"
   • Select the four status checks listed above as required

Note: If GitHub Advanced Security is not enabled for this private repository, the CodeQL workflow may not run. In that case, omit CodeQL / Analyze (JavaScript) from required checks until GHAS is enabled.

This establishes a solid foundation for enforcing code quality and security standards while maintaining development velocity.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.