ci: CodeQL as a workflow, and a SECURITY.md

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+# CodeQL on the TypeScript and the workflows, with the security-and-quality queries: on every pull request, on main and
+# weekly for newly published queries. Results go to the Security tab; the main ruleset requires them.
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions: {}
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write # uploads the results
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-and-quality
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          category: /language:${{ matrix.language }}

README.md

@@ -213,6 +213,12 @@ that does nothing.
     required status check.
 - **`scorecard.yml`**: [OpenSSF Scorecard](https://scorecard.dev) on pushes to `main` and weekly.
   Its own workflow because publishing results restricts what else the workflow may contain.
+- **`codeql.yml`**: CodeQL on the code and the workflows (`actions`, `javascript-typescript`) with the
+  `security-and-quality` queries, on pull requests, `main` and weekly. A workflow rather than GitHub's
+  default setup, so the queries and languages are in the repository; the `main` ruleset requires its
+  results. (Turn the default setup off: GitHub rejects a workflow's results while it is on.)
+- **`SECURITY.md`**: supported versions and a link to private vulnerability reporting (enabled in the
+  repository settings).
 - **`.github/dependabot.yml`** with a 7-day cooldown.
 - Bot actions (Dependabot auto-merge) run as the devenvy-bot GitHub App — org variable
   `DEVENVY_BOT_CLIENT_ID`, org secret `DEVENVY_BOT_PRIVATE_KEY`, both also as Dependabot secrets —

SECURITY.md

@@ -0,0 +1,18 @@
+# Security
+
+## Supported versions
+
+| Version                                       | Supported                        |
+| --------------------------------------------- | -------------------------------- |
+| The latest `@devenvy/code-guidelines` release | Yes: fixes ship as a new release |
+| Older releases                                | No: update to the latest         |
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately, through GitHub's private vulnerability reporting:
+[report a vulnerability](https://github.com/devenvy/code-guidelines-ecma/security/advisories/new) (Security,
+Advisories, **Report a vulnerability**). Please don't open a public issue. You'll get an answer within a week, and the
+fix and advisory are published together.
+
+In scope: the CLI (`init`, `sync`, `check` and what they write into a repository), the shared ESLint, Prettier and
+tsconfig configurations, and the workflows. Vulnerabilities in ESLint, Prettier or their plugins belong upstream.