Set up CodeQL code scanning

[jbeckwith-oai]

Summary

• add a CodeQL workflow for the repository's Python source
• scan pull requests and pushes to main
• allow manual scans through workflow_dispatch
• use least-privilege workflow permissions and immutable action SHAs

Why

This enables GitHub code scanning so security findings can be surfaced directly on pull requests and in the repository's Security tab. The workflow intentionally has no scheduled trigger.

Validation

• parsed the workflow as YAML
• ran git diff --check

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[openai-sdks]

OkTest Summary

❌ 234/237 SDK tests passed in 12.179s for Python SDK PR #3514.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	221ms
tests/chat-completions-create.test.ts	✅ Passed	278ms
tests/chat-completions-stream.test.ts	✅ Passed	144ms
tests/files-content-binary.test.ts	✅ Passed	225ms
tests/files-create-multipart.test.ts	✅ Passed	276ms
tests/files-list-pagination.test.ts	✅ Passed	182ms
tests/initialize-config.test.ts	✅ Passed	183ms
tests/instance-isolation.test.ts	✅ Passed	269ms
tests/models-list.test.ts	✅ Passed	263ms
tests/responses-background-lifecycle.test.ts	✅ Passed	249ms
tests/responses-body-method-errors.test.ts	✅ Passed	345ms
tests/responses-cancel-timeout.test.ts	✅ Passed	243ms
tests/responses-cancel.test.ts	✅ Passed	243ms
tests/responses-compact-retries.test.ts	✅ Passed	394ms
tests/responses-compact.test.ts	✅ Passed	349ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	157ms
tests/responses-create-advanced.test.ts	✅ Passed	245ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.312s
tests/responses-create-errors.test.ts	✅ Passed	249ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	259ms
tests/responses-create-retries.test.ts	✅ Passed	295ms
tests/responses-create-stream-failures.test.ts	✅ Passed	136ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	234ms
tests/responses-create-stream-wire.test.ts	✅ Passed	3.938s
tests/responses-create-stream.test.ts	✅ Passed	147ms
tests/responses-create-terminal-states.test.ts	✅ Passed	273ms
tests/responses-create-timeout.test.ts	✅ Passed	245ms
tests/responses-create.test.ts	✅ Passed	297ms
tests/responses-delete.test.ts	✅ Passed	240ms
tests/responses-input-items-errors.test.ts	✅ Passed	395ms
tests/responses-input-items-list.test.ts	❌ Failed	340ms
tests/responses-input-items-options.test.ts	❌ Failed	309ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	265ms
tests/responses-input-tokens-count.test.ts	✅ Passed	279ms
tests/responses-malformed-inputs.test.ts	✅ Passed	3.103s
tests/responses-not-found-errors.test.ts	✅ Passed	286ms
tests/responses-parse.test.ts	✅ Passed	443ms
tests/responses-retrieve-retries.test.ts	✅ Passed	402ms
tests/responses-retrieve.test.ts	✅ Passed	247ms
tests/responses-stored-method-errors.test.ts	✅ Passed	727ms
tests/retry-behavior.test.ts	✅ Passed	3.29s
tests/sdk-error-shape.test.ts	✅ Passed	401ms

View OkTest run #29606490030

_{SDK merge (441274dd3c38) · head (b63c6a2da460) · base (0e6adb15adc1) · OkTest (fd7a761c81c1)}

[HAYDEN-OAI]

looks good, thanks for setting this up!