ci(codeql): analyze only actions + javascript-typescript

[echobt]

What this is

Fixes the CodeQL failure on main after #23 merged (f80d0f8). The docs site has no Python source, so the Analyze (python) job fails with CodeQL could not process any code written in Python / no-source-code-seen-during-build. CI-only change: one new workflow file, no page or product code touched.

Why it was failing

PR #23 deleted the last Python file in the tree (scripts/generate-docs-frames.py, 541 lines), which made the tracked Python count zero:

$ git ls-files '*.py' | wc -l
0

CodeQL for this repository is not configured by a file in the tree. It runs from GitHub's dynamic default-setup workflow (dynamic/github-code-scanning/codeql), whose language matrix lives in repository settings and still lists python. With no Python files left, that job cannot build a database and fails at finalize:

Error: CodeQL could not process any code written in Python. For more information, review our
troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build
Encountered a fatal error while running ".../codeql database finalize ... /codeql_databases/python".
Exit code was 32 ...
CodeQL job status was configuration error.

The same run shows the other two languages are fine, so only the empty language is the problem:

Job	Result on the failing run
Analyze (actions)	success
Analyze (javascript-typescript)	success
Analyze (python)	failure (no source)

Note this is not a one-off: the identical failure shape hit main at 10:31 (Analyze (javascript-typescript) failed then, because scripts/*.mjs had been removed in an earlier state and only the workflow YAML was left). The matrix tracks the tree, and the tree changed.

The fix

Add .github/workflows/codeql.yml — an explicit advanced-setup workflow whose matrix is pinned in the repository instead of derived from settings:

matrix:
  include:
    - language: actions
      build-mode: none
    - language: javascript-typescript
      build-mode: none

• actions and javascript-typescript are the two languages the tree actually contains (.github/workflows/*.yml and scripts/**/*.mjs).
• python is deliberately absent, with a comment in the matrix recording why and what to do before adding it back.
• Both use build-mode: none, matching the generated configuration the repository was already running.
• permissions are least-privilege (contents: read, security-events: write), and checkout uses persist-credentials: false like the existing ci.yml.
• Triggers mirror ci.yml (push/pull_request on main) plus the weekly CodeQL schedule.

Committing a CodeQL workflow is the documented way to take ownership of the language list: GitHub disables default setup when an advanced-setup workflow for CodeQL is detected, so the settings-side matrix that still lists python stops driving the run.

Verification

$ node scripts/check-docs-site.mjs
check-docs-site: ok (24 problem pages; site-only, backend contract not checked)
$ node scripts/check-docs-content.mjs
check-docs-content: ok (173 page(s))
$ bash scripts/tests/check-docs-site.test.sh
check-docs-site: ok
$ bash scripts/tests/check-docs-content.test.sh
check-docs-content.test.sh: ok
$ node scripts/tests/docs-ui.test.mjs
docs-ui: starter theme, product tabs, icons, anchors and footer passed
$ npm exec --yes --package=mint@4.2.876 -- mint validate
success build validation passed

The workflow YAML parses, and the parsed matrix contains exactly ['actions', 'javascript-typescript'].

Test plan

• Docs site CI job passes on this PR
• CodeQL runs on this PR with jobs Analyze (actions) and Analyze (javascript-typescript) only, both green, and no Analyze (python) job
• After merge, the push run on main is green

[echobt]

@greptileai

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
cortex-foundation-add13747	🟢 Ready	View Preview	Sep 16, 2026, 6:45 PM

💡 Tip: Enable Automations to automatically generate PRs for you.