Why

Code scanning runs under GitHub's default setup, which analyses only refs/heads/main and
refs/pull/*. No release tag or release branch commit has ever been analysed: the
r1.0.0-alpha1 tag commit (20ecf4d8) was not scanned. Exporting static analysis for a
release, as required by DRIVERS-2894, therefore has nothing to reference.

Release branches are not a substitute for tags. bump-version.sh commits, and
bump-and-tag.sh tags between two such commits, so a release branch head is the
next-snapshot commit, one past the tag. Analysing the branch would report on a commit the
release does not contain.

What

Add .github/workflows/codeql.yml calling mongodb-labs/drivers-github-tools/codeql@v3,
pinned by sha, and disable default setup, which cannot coexist with a workflow-based setup.* Two matrix entries: java-kotlin and actions.

• Triggers: push to main and .x, push of r tags, pull_request, weekly schedule, and
  workflow_call with a ref input so a release can request analysis of a given ref.
• java-kotlin uses build-mode manual with the command ./gradlew classes. Bare task-name
  invocation runs classes in the root project and both Spring Boot subprojects, so all
  three published modules are extracted. example-module is absent from settings.gradle.kts
  and is excluded for free, as are all test sources.
• Query suite security-extended, matching the action default and the other drivers repos.
• An explicit JDK 17 setup step: the Gradle toolchain is pinned to 17 and
  settings.gradle.kts registers no toolchain resolver, so provisioning otherwise relies on
  runner-image auto-detection.
• paths-ignore for Gradle output directories.

Why manual rather than the current buildless extraction

Buildless extraction is measurably degraded. The most recent main analysis scanned 288 of
312 Java files, and its diagnostics report that hibernate-core 7.2.19.Final and
mongodb-driver-sync 5.6.2 were dropped, and that classpath entries had to be inferred from
package names used in source. Those are the two libraries this project exists to call, and
dataflow queries cannot follow a call they could not resolve. Kotlin, including the buildSrc
convention plugins, is not analysed at all under default setup.

manual is preferred over autobuild because the extracted set is then exactly the published
modules' main sources, with no guessing about which tasks autobuild selects and no silent
degradation. The cost is a build command that can drift from the Gradle setup.

Accepted consequence: compiling under CodeQL makes the job a second compile gate, since the
build uses -Werror and treats NullAway findings as errors.

Verification

• PR run compiles all three modules, emits no inferred-classpath diagnostic and no dropped
  hibernate-core or mongodb-driver-sync, and extracts Kotlin.
• A tag push produces an analysis under refs/tags/. Confirm with a throwaway tag, then
  delete the tag.
• Both categories are present: /language:java-kotlin and /language:actions.
• The SARIF for the tag commit is retrievable:

  gh api \-H "Accept: application/sarif\+json" 
  "repos/mongodb/mongo\-hibernate/code\-scanning/analyses/"
  

• security-extended will likely surface findings where default setup reported none. Triage
  is part of this ticket; the compliance report needs a justification per dismissal.