Add CodeQL configuration file

[evanwilson-arch]

Description

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Test update

Changes Made

Compatibility / Package Source

• Unity version(s) tested:
• Package source used (#beta, #main, tag, branch, or file:):
• Resolved commit hash from Packages/packages-lock.json (if using a Git package URL):

Testing/Screenshots/Recordings

• Python tests (cd Server && uv run pytest tests/ -v)
• Unity EditMode tests
• Unity PlayMode tests
• Package import/compile check
• Not applicable (explain why in Additional Notes)

Documentation Updates

• I have added/removed/modified tools or resources
• If yes, I have updated all documentation files using:
  • The LLM prompt at tools/UPDATE_DOCS_PROMPT.md (recommended)
  • Manual review of the generated changes

Related Issues

Additional Notes

Summary by CodeRabbit

• Chores
  • Added automated CodeQL security analysis for the beta branch, beta-targeted pull requests, and scheduled weekly scans across C# and Python.
  • Updated the MCPForUnity package version to 10.1.1-beta.3.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9f641c70-65ab-4d12-a722-548e331898c7

📥 Commits

Reviewing files that changed from the base of the PR and between 7f2729d and 84457d9.

📒 Files selected for processing (1)

• MCPForUnity/package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• MCPForUnity/package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a CodeQL Advanced workflow for C# and Python analysis on beta branch activity and a weekly schedule. Updates the Unity package version from 10.1.1-beta.1 to 10.1.1-beta.3.

Changes

Infrastructure and Release Update

Layer / File(s)	Summary
CodeQL workflow definition .github/workflows/codeql.yml	Adds beta push and pull request triggers, a weekly schedule, C# and Python matrix analysis, required permissions, and CodeQL initialization and analysis steps.
Version bump to beta.3 MCPForUnity/package.json	Updates the package version from 10.1.1-beta.1 to 10.1.1-beta.3.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: jordandunmire97-ai

Merge Risk: ⚪ Minimal · up to 84457

The current change advances the Unity package beta version without an identified release or runtime risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description includes the required headings but provides no substantive details. It does not describe the changes, select a change type, report testing, document compatibility or package source, id…	Complete the description with a summary of the CodeQL workflow and package version update. Select the applicable change type. Record testing or explain why testing is not applicable. Complete compatibility and package-source fields where re…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: adding CodeQL configuration. It is concise and related to the new workflow, although it does not mention the package version update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required headings but provides no substantive details. It does not describe the changes, select a change type, report testing, document compatibility or package source, identify documentation updates, link related issues, or provide additional notes.

Resolution

Complete the description with a summary of the CodeQL workflow and package version update. Select the applicable change type. Record testing or explain why testing is not applicable. Complete compatibility and package-source fields where relevant. State whether documentation changed, add related issues if applicable, and include additional notes such as the required rebase and conflict resolution.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch beta

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codeql.yml:
- Line 60: Replace all mutable action version tags with full commit SHAs in the
workflow file to reduce supply-chain risk. Update the `actions/checkout@v4`
action at lines 60, 70, and 99 by replacing the `@v4` tag with the full commit
SHA of that specific version (for example,
`actions/checkout@<full-commit-sha>`). This ensures the workflow uses an
immutable reference that cannot drift due to tag updates.
- Around line 59-60: The actions/checkout@v4 step in the codeql.yml workflow is
missing the persist-credentials configuration which is a security best practice.
Add a with clause to the Checkout repository step with persist-credentials set
to false to prevent the checkout action from persisting git credentials in the
repository, reducing token exposure risk and following the principle of least
privilege.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0eee911c-c6c9-4576-8f51-4bc11e8a053a

📥 Commits

Reviewing files that changed from the base of the PR and between dccecd6 and ee4b96e.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[jordandunmire97-ai]

I appreciate everything about a soul who can understand. I wish for you too. No one else cares . It's a sad world . Im okay I just have realized much that I did not want to .

[Scriptwonder]

hi there! can you rebase to the latest version and resolve the conflicts? Will review them soon.