Enable CodeQL checks for GitHub Actions workflows (#4656)

see https://github.blog/security/application-security/how-to-secure-your-github-actions-workflows-with-codeql

Author: marcphilipp

.github/workflows/codeql-analysis.yml

@@ -27,18 +27,24 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language:
-          - java
-          - javascript
+        include:
+          - language: actions
+            build-mode: none
+          - language: java
+            build-mode: manual
+          - language: javascript
+            build-mode: none
     steps:
     - name: Check out repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Initialize CodeQL
       uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
       with:
         languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
         tools: linked
     - name: Build
+      if: matrix.build-mode == 'manual'
       uses: ./.github/actions/run-gradle
       with:
         encryptionKey: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
@@ -48,3 +54,5 @@ jobs:
           classes
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+      with:
+        category: "/language:${{matrix.language}}"