[AAASM-3434] 🔧 (ci): run CodeQL on push to master (default-branch coverage)

[Chisanan232]

Description

python-sdk recorded 0 CodeQL analyses on master (gh api repos/ai-agent-assembly/python-sdk/code-scanning/analyses → HTTP 404 "no analysis found"; default-setup not-configured), leaving the code-scanning dashboard empty with no scheduled scan. There was no CodeQL workflow in the repo at all.

This PR adds .github/workflows/codeql.yml, mirroring go-sdk's codeql.yml, so CodeQL analysis + SARIF upload runs on push to master and on a weekly schedule, while keeping PR runs. Adapted for Python: languages: python with build-mode: none (no build step needed for interpreted analysis), and security-events: write so SARIF can be uploaded on the master path.

CI-config only — no source changes.

Type of Change

• 🔧 Bug fix

Breaking Changes

• No

Related Issues

• Related JIRA ticket: AAASM-3434
• Related GitHub issues: #XX

Testing

• No tests required (explain why)

CI-config only. Validated locally with actionlint .github/workflows/codeql.yml — clean. Triggers confirmed by inspection: push.branches: [master] + schedule.cron: "0 3 * * 1" + pull_request. Post-merge AC: an analysis will record on master (gh api repos/ai-agent-assembly/python-sdk/code-scanning/analyses).

Checklist

• Code follows project style guidelines
• Self-review completed
• All tests passing

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Chisanan232]

🟢 Review result — Claude Code (AAASM-3434)

Verdict: APPROVED — ready for approval & merge.

1. CI status — green

Analyze (python) ✅ · CodeQL aggregate ✅ · analyze ✅. No failures. (BLOCKED = required Pioneer approval, not a CI failure.)

2. Scope vs ticket (AAASM-3434)

• ✅ Root cause corrected during impl: python-sdk had no CodeQL workflow at all (default-setup not-configured, code-scanning/analyses → 404). Fix = new committed .github/workflows/codeql.yml.
• ✅ Triggers: push: branches:[master] + weekly schedule + pull_request; permissions: security-events: write; language python, build-mode: none; pinned action SHAs; mirrors go-sdk (Autobuild dropped — Python is interpreted).
• ✅ actionlint clean; CI-config only, no source changes.

Post-merge: I'll confirm the security analysis records on master (gh api repos/ai-agent-assembly/python-sdk/code-scanning/analyses). Ready to merge.