ci: apply CodeQL Copilot feedback from #394

[jimmyandrade]

Summary

• Follow-up to Add CodeQL workflow for GitHub code scanning #394: the squash merge landed the original LGTM workflow (master, checkout@v3, codeql-action@v2).
• Applies Copilot review feedback from Add CodeQL workflow for GitHub code scanning #394: target main, actions/checkout@v4, github/codeql-action/*@v3.

Test plan

• Confirm workflow file on the PR matches Copilot suggestions
• After merge, verify CodeQL runs on a push/PR to main

Made with Cursor

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Updates the repository’s CodeQL GitHub Actions workflow to align with current defaults and recommended action versions, following up on the earlier LGTM-generated workflow.

Changes:

• Switch CodeQL workflow triggers from master to main for both push and pull_request.
• Upgrade actions/checkout to v4.
• Upgrade github/codeql-action steps (init, autobuild, analyze) to v3.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.