feat: integrate with poly-ssg-mcp hub #2

	# SPDX-License-Identifier: AGPL-3.0-or-later
	# RSR-compliant CodeQL workflow with SHA-pinned actions

	name: "CodeQL"

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]
	schedule:
	- cron: '42 20 * * 0'

	permissions: read-all

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	packages: read
	actions: read
	contents: read

	strategy:
	fail-fast: false
	matrix:
	include:
	# Uncomment languages used in your project
	# - language: rust
	# build-mode: manual
	# - language: go
	# build-mode: autobuild
	# - language: java-kotlin
	# build-mode: autobuild
	- language: javascript-typescript
	build-mode: none
	# - language: python
	# build-mode: none

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Initialize CodeQL
	uses: github/codeql-action/init@ea9e4e37992a54ee68a9571571f9a567d8f90f78 # v3.28.0
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}

	- name: Build (manual mode)
	if: matrix.build-mode == 'manual'
	shell: bash
	run: \|
	echo "Manual build required - add your build commands here"
	# cargo build --release
	# mix compile
	exit 1

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@ea9e4e37992a54ee68a9571571f9a567d8f90f78 # v3.28.0
	with:
	category: "/language:${{ matrix.language }}"

Provide feedback