Add CodeQL analysis for Go code

[HTHou]

Add CodeQL analysis for the Go module using build-mode: manual. The Go API uses CGO, so analysis needs the native TsFile headers and library; without them, extraction reports a missing cwrapper/errno_define_c.h header and cannot resolve import "C".

The Go job sets up Java and Go, installs uuid-dev, and builds the native library before initializing CodeQL. It then runs CGO_ENABLED=1 go build -a ./... from go/ under CodeQL tracing. The -a flag rebuilds cached packages so their compilation is captured. The existing manual C++ build step is restricted to the C++ matrix entry.

The Java matrix entry is also renamed from java-kotlin to java, retaining build-mode: none.

Validation:

• Local actionlint, native library build, and CGO_ENABLED=1 go build -a ./... passed.
• CodeQL run for b43cfc71: all four language jobs passed. Go analysis ran 34 rules with 0 alerts, reported 0 raw diagnostic messages, and uploaded its results successfully. The previous CGO extraction errors are absent.
• The PR-level CodeQL check still reports a configuration comparison warning because the Java category is now /language:java, while develop uses /language:java-kotlin.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.94%. Comparing base (5e207cd) to head (b43cfc7).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #957      +/-   ##
===========================================
- Coverage    63.94%   63.94%   -0.01%     
===========================================
  Files          758      758              
  Lines        53249    53241       -8     
  Branches      8446     8443       -3     
===========================================
- Hits         34051    34045       -6     
+ Misses       17535    17533       -2     
  Partials      1663     1663              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

The workflow matches the Go CGO build requirements and the referenced four-language CodeQL run completed successfully.

Pull request overview

Adds CodeQL analysis for the CGO-based Go module while preserving existing language scans.

Changes:

• Adds a manual Go CodeQL matrix job.
• Builds native TsFile dependencies before traced Go compilation.
• Renames the Java matrix identifier while retaining Java-only analysis.

File summaries

File	Description
.github/workflows/codeql.yml	Configures Go prerequisites, native build, and CodeQL-traced compilation.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.