ci: T9082: modernize CodeQL reusable — codeql-action v4 + build-mode input

[andamasov]

Track A of the vyos-org CodeQL rollout (T9082, IS-610).

What

• github/codeql-action/{init,autobuild,analyze} v3 → v4 (v3 is deprecation-bound; v4 runs on Node 24).
• New optional build-mode input (none / autobuild / manual), passed through to codeql-action/init. When set, the explicit Autobuild step is skipped (none/autobuild are handled by codeql-action itself; manual requires and runs build-command).
• Leading input-validation step — fails fast on invalid build-mode/build-command combinations before any scanning cost.
• Languages doc string corrected to current canonical ids.

Unset build-mode keeps the same legacy behavior contract (explicit Autobuild step, or Manual build when build-command is provided) — all 4 existing callers (vyatta-cfg, vyatta-bash, vyos-build, vyos-1x) exercise only that path.

Pre-merge verification (in flight)

Two canary caller PRs run pinned to this branch's SHA before merge: ipaddrcheck exercises the legacy autobuild row on v4, the validation failure path, and build-mode: none; rest.vyos exercises the legacy interpreted row. Post-merge, the 4 existing callers' latest runs are actively re-run (rerun re-resolves @production).

Phase 0 (local CodeRabbit) dispositions

• Major — build-command shell interpolation in the Manual build step: pre-existing behavior, unchanged by this PR. workflow_call inputs come from a caller workflow committed to the calling repo — anyone able to set build-command can already run arbitrary steps in that repo's own workflows; no trust boundary is crossed. An allowlist would break the documented manual-build flexibility.
• Minor — validate build-mode: none against language (Go/Kotlin/Swift unsupported): skipped; codeql-action/init already fails fast with a clear upstream error for unsupported combinations, and duplicating its compatibility table here invites drift. Fleet callers use none only for c-cpp/python/javascript.

Advances: IS-610

🤖 Generated by robots

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: d1fccd04-4e54-4bcc-a9fe-a281d7ee181f

📥 Commits

Reviewing files that changed from the base of the PR and between 1c807e1 and b008240.

📒 Files selected for processing (1)

• .github/workflows/codeql-analysis.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated automated security analysis to use the latest CodeQL action version.
  • Added validation for build settings, including supported build modes and valid build-command combinations.
  • Improved configuration guidance for supported language aliases.
  • Added conditional handling for automatic, manual, and disabled build modes.

Walkthrough

Changes

CodeQL workflow

Layer / File(s)	Summary
Build input contract and validation .github/workflows/codeql-analysis.yml lines 1–22, 43–65	Language aliases are documented, optional build-mode is added, and invalid build-mode/build-command combinations fail validation.
CodeQL v4 build integration .github/workflows/codeql-analysis.yml lines 83–103	CodeQL actions are upgraded to @v4; init, autobuild, manual build, and analyze now use build-mode-aware wiring.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/codeql-security-scanning-802bf8

---

_{Comment @coderabbitai help to get the list of available commands.}

[andamasov]

Adversarial review — b0082401423f12eb68200266227edc8bb54c9937 — Codex + agy parallel

NO FINDINGS (both providers).

Both reviewers independently verified: GHA expression semantics of the new if: guards (empty-string input falsiness preserves the legacy autobuild/manual paths), env-mapped inputs in the validation step (no inline interpolation), and the codeql-action v4 contract (empty build-mode passthrough = unset; init/autobuild/analyze bumped together).

---

Each finding must receive a fix commit OR a pushback reply in a reply to this comment before merge. See /audit-pr-threads for resolution mechanics.