ci: manage codeql workflow in repo

tests/github-automation.test.cjs

@@ -20,6 +20,7 @@ test('repository automation files exist for CI, container publish, and Dependabo
     '.eslintrc.cjs',
     '.eslintignore',
     '.github/workflows/ci.yml',
+    '.github/workflows/codeql.yml',
     '.github/workflows/image.yml',
     '.github/workflows/dependabot-auto-merge.yml',
     '.github/dependabot.yml',
@@ -45,6 +46,29 @@ test('container image publishing waits for CI instead of running on pull request
   assert.doesNotMatch(workflow, /pull_request:/);
 });
 
+test('workflows opt into Node 24 for JavaScript-based GitHub Actions', () => {
+  const workflows = [
+    read('.github/workflows/ci.yml'),
+    read('.github/workflows/codeql.yml'),
+    read('.github/workflows/image.yml'),
+    read('.github/workflows/dependabot-auto-merge.yml'),
+  ];
+
+  for (const workflow of workflows) {
+    assert.match(workflow, /FORCE_JAVASCRIPT_ACTIONS_TO_NODE24:\s*true/);
+  }
+});
+
+test('CodeQL workflow uses advanced setup with repository-managed configuration', () => {
+  const workflow = read('.github/workflows/codeql.yml');
+
+  assert.match(workflow, /uses:\s*actions\/checkout@v5/);
+  assert.match(workflow, /uses:\s*github\/codeql-action\/init@v4/);
+  assert.match(workflow, /uses:\s*github\/codeql-action\/analyze@v4/);
+  assert.match(workflow, /language:\s*actions/);
+  assert.match(workflow, /language:\s*javascript-typescript/);
+});
+
 test('dependabot config covers npm, docker, and github-actions updates', () => {
   const dependabot = read('.github/dependabot.yml');