fix(ci): build zredis modules for CodeQL

[ss-o]

Summary

• replace the mutable CodeQL autobuild workflow with an explicit Actions/none and C/C++/manual matrix
• build the zredis Redis and GDBM modules with verified dependencies and feature checks
• add a structural workflow contract test and pin third-party actions to immutable commit SHAs

Root cause

Default C/C++ setup reached the bundled module configure step, but generated autobuild could not complete the headless build and did not detect GDBM. The existing advanced workflow also used autobuild, mutable action tags, and incomplete build dependencies.

Safety and migration

• pull requests run the full analysis with upload: never while default setup remains active
• pushes, schedules, and explicitly enabled manual runs can upload only after the separately approved live switch
• this PR does not change repository or organization CodeQL settings
• do not merge until the Task 7C live migration window is explicitly authorized
• rollback before that window is to close this draft PR and leave default setup plus security configuration 17 unchanged
• this overlaps the checkout major-version update in build(deps): bump actions/checkout from 6 to 7 #9; build(deps): bump actions/checkout from 6 to 7 #9 remains unchanged for maintainer evaluation

Validation

• structural contract: honest RED before implementation, then GREEN
• mutation checks rejected a missing matrix entry, missing dependency, and mutable checkout pin
• actionlint v1.7.12
• zsh -n and compiled Zsh test syntax
• clean Ubuntu 24.04 configure and build verified all four feature macros and all three modules
• post-commit contract and lint checks passed

Relates to #10.

[Copilot]

Pull request overview

This PR replaces the existing CodeQL workflow’s autobuild-based setup with an explicit matrix that runs actions analysis with build-mode: none and c-cpp analysis with build-mode: manual, including a deterministic build of the zredis modules and a structural “contract” test to prevent workflow drift.

Changes:

• Replace CodeQL autobuild with an explicit actions/none + c-cpp/manual matrix and manual module build checks.
• Add a workflow_dispatch input to control whether analysis uploads results, and pin actions to immutable SHAs.
• Add a Zsh-based workflow contract test that validates the expected workflow structure via yq.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/codeql-analysis.yml	Switches to an explicit CodeQL matrix and performs a manual C/C++ build + feature/module-output checks before analysis.
.github/tests/codeql-workflow.zsh	Adds a structural contract test that asserts the workflow’s matrix, permissions, pins, and analysis/upload behavior.

Comments suppressed due to low confidence (2)

.github/workflows/codeql-analysis.yml:94

• workflow_dispatch boolean inputs are exposed as strings in expressions; comparing inputs.upload-results to the boolean literal true can prevent uploads when the checkbox is selected because the value is typically the string "true".

      - name: Analyze and upload
        if: github.event_name == 'push' || github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.upload-results == true)
        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3

.github/tests/codeql-workflow.zsh:142

• This contract test asserts the workflow uses inputs.upload-results == true, but workflow_dispatch boolean inputs are represented as strings ("true"/"false") in expressions. The contract should match the corrected string comparison so uploads occur when the checkbox is selected.

        .uses ==
          "github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81" and
        .if ==
          "github.event_name == '\''push'\'' || github.event_name == '\''schedule'\'' || (github.event_name == '\''workflow_dispatch'\'' && inputs.upload-results == true)" and
        .with.category == "/language:${{ matrix.language }}" and
        (.with | has("upload") | not))] |

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.