Add CodeQL SAST workflow for TypeScript

[drsteinerdj]

Summary

• add a CodeQL workflow for JavaScript/TypeScript pull requests, weekly scans, and manual runs
• configure the security-and-quality query suite and exclude generated/build output
• add SARIF post-processing so error-level or critical-severity findings fail the check while warnings remain review-only
• document CodeQL coverage and triage in docs/security.md

Closes #275

Validation

• git diff --check
• verified github/codeql-action/analyze supports the output and sarif-output fields used by the workflow

[vercel]

@drsteinerdj is attempting to deploy a commit to the vjulia0008-2485's projects Team on Vercel.

A member of the Team first needs to authorize it.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a0e586fd1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Look up CodeQL severity on the rule descriptor

When a critical CodeQL security query reports a warning-level result, this gate will not block it because CodeQL stores security-severity on the SARIF rule descriptor (run.tool.driver.rules[...]); GitHub's SARIF docs describe properties.security-severity on the reportingDescriptor object, while each result only references that rule with ruleId/ruleIndex. For example, js/unsafe-deserialization is Severity: warning but Security severity: 9.8, so this code counts it as a warning and exits successfully even though the workflow documentation says critical security severity is a release blocker.

Useful? React with 👍 / 👎.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tariff-shield-web	Error		Jun 27, 2026 5:29pm

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `rootDirectory`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration