Enable CodeQL on 6 SDK repos (default-setup, no workflow file needed)

[pimfeltkamp]

Iter-48 audit found all 9 SDK repos have Dependabot configured (good, consistent), but none have CodeQL static-analysis scanning enabled. CodeQL is GitHub's free static security scanner and would catch a class of issues Dependabot doesn't (e.g. SQL/command/path injection, unsafe deserialisation, hardcoded secrets, unsafe regex, dangerous reflection, etc.).

What's possible per repo

I queried each repo's /code-scanning/default-setup endpoint to see what GitHub auto-detected. All 6 CodeQL-supported repos return state: not-configured:

Repo	CodeQL would scan	Status
cryptohopper-cli	javascript, typescript, actions	not-configured
cryptohopper-node-sdk	javascript, typescript, actions	not-configured
cryptohopper-python-sdk	python, actions	not-configured
cryptohopper-go-sdk	go, actions	not-configured
cryptohopper-ruby-sdk	ruby, actions	not-configured
cryptohopper-swift-sdk	swift, actions	not-configured

The actions scan is the GitHub Actions workflow security check — catches things like the missing permissions: blocks I flagged in #7, unpinned reusable-workflow refs, secret-in-output, etc.

Not CodeQL-eligible (need alternatives)

CodeQL doesn't support these three languages today. If you want static security scanning on them, third-party options:

Repo	Reason	Alternative if desired
cryptohopper-rust-sdk	CodeQL doesn't support Rust yet	cargo audit is already in CI; consider cargo-vet for supply-chain
cryptohopper-php-sdk	No CodeQL PHP support	Psalm or Phan for static analysis
cryptohopper-dart-sdk	No CodeQL Dart support	dart analyze --fatal-infos is already in CI

How to enable

GitHub introduced "default setup" for CodeQL — one-click, no workflow file to commit. For each repo:

1. Repo Settings → Code security → Code scanning → CodeQL → Set up → Default.
2. Confirm the auto-detected language list.
3. Click Enable CodeQL.

Or via the API (which is what I'd do if you signal go):

gh api -X PATCH repos/cryptohopper/cryptohopper-cli/code-scanning/default-setup \
  -f state=configured \
  -f query_suite=default \
  -f 'languages[]=javascript-typescript' -f 'languages[]=actions'

Same for the other 5. Each takes ~2 minutes for the first scan to complete.

Why I'm asking, not just enabling

Topics in iter 40 were a no-impact metadata change — couldn't break anything. CodeQL has ongoing implications:

• Actions minutes — small but non-zero; ~3-5 minutes per push to main per repo. Across 6 repos, weekly rebuilds, ~3000 minutes/year. Cryptohopper has unlimited Actions minutes on public repos so this is free, but worth flagging.
• Findings to triage — first scan often surfaces a handful of issues (severity ranges from "low/code-quality" to "high/security"). Someone has to decide on each: fix, accept-as-suppression, or dismiss with reason.
• Notifications — security-tab findings page-everyone-with-write-access by default.

If you signal go, I'll enable all 6 via the API in one batch and report what each first-scan turns up.

Cross-references

• Companion infrastructure issues: #6 stale CHANGELOGs, #7 missing CI permissions.