ci: run CodeQL analysis for merge-queue entries

[HAYDEN-OAI]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

• Run the existing advanced Python CodeQL analysis on merge_group checks_requested events, in addition to the existing main-targeted pull-request, main-push, and manual paths.
• Preserve the stable Analyze Python job/check name, SARIF category, Python language, timeout, full-SHA CodeQL/checkout action pins, and existing actions: read, contents: read, security-events: write permissions.
• Set persist-credentials: false on checkout so repository credentials are not left available to subsequent analysis steps.
• Keep ordinary pull_request behavior for external forks; existing repository policy still requires a maintainer to approve external-contributor workflow execution.

Verification

• Parsed as YAML 1.2 and validated against the current GitHub Actions workflow JSON Schema.
• Structural/event assertions confirm real CodeQL init + analyze, existing PR/push/manual behavior, merge-queue-only checks_requested, unchanged job/check identity and permissions, three immutable action pins, and no skipped placeholder or pull_request_target.
• Confirmed a previously maintainer-approved external-fork PR completed the real Analyze Python job successfully.
• python scripts/check-python-version-policy.py
• git diff origin/main...HEAD --check

Required-check rollout safety

The active main ruleset already requires a merge queue, but there have been zero CodeQL merge_group runs. Requiring any CodeQL check immediately would deadlock legitimate merges, so this PR does not modify live rules.

After this workflow reaches main, confirm Analyze Python succeeds on an actual merge-group SHA and an approved fork PR. Only then add { "context": "Analyze Python", "integration_id": 15368 } to the existing required checks while preserving every current rule. The separate CodeQL Advanced Security check and dynamic Analyze (python) check are not proven to run on merge-group events.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.032s for Python SDK PR #3643.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	137ms
tests/chat-completions-create.test.ts	✅ Passed	209ms
tests/chat-completions-stream.test.ts	✅ Passed	98ms
tests/files-content-binary.test.ts	✅ Passed	169ms
tests/files-create-multipart.test.ts	✅ Passed	210ms
tests/files-list-pagination.test.ts	✅ Passed	133ms
tests/initialize-config.test.ts	✅ Passed	112ms
tests/instance-isolation.test.ts	✅ Passed	137ms
tests/models-list.test.ts	✅ Passed	222ms
tests/responses-background-lifecycle.test.ts	✅ Passed	161ms
tests/responses-body-method-errors.test.ts	✅ Passed	279ms
tests/responses-cancel-timeout.test.ts	✅ Passed	205ms
tests/responses-cancel.test.ts	✅ Passed	192ms
tests/responses-compact-retries.test.ts	✅ Passed	245ms
tests/responses-compact.test.ts	✅ Passed	194ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	92ms
tests/responses-create-advanced.test.ts	✅ Passed	160ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.058s
tests/responses-create-errors.test.ts	✅ Passed	179ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	85ms
tests/responses-create-retries.test.ts	✅ Passed	230ms
tests/responses-create-stream-failures.test.ts	✅ Passed	113ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	190ms
tests/responses-create-stream-wire.test.ts	✅ Passed	2.834s
tests/responses-create-stream.test.ts	✅ Passed	160ms
tests/responses-create-terminal-states.test.ts	✅ Passed	258ms
tests/responses-create-timeout.test.ts	✅ Passed	192ms
tests/responses-create.test.ts	✅ Passed	409ms
tests/responses-delete.test.ts	✅ Passed	145ms
tests/responses-input-items-errors.test.ts	✅ Passed	308ms
tests/responses-input-items-list.test.ts	✅ Passed	236ms
tests/responses-input-items-options.test.ts	✅ Passed	261ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	216ms
tests/responses-input-tokens-count.test.ts	✅ Passed	188ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.022s
tests/responses-not-found-errors.test.ts	✅ Passed	196ms
tests/responses-parse.test.ts	✅ Passed	285ms
tests/responses-retrieve-retries.test.ts	✅ Passed	182ms
tests/responses-retrieve.test.ts	✅ Passed	156ms
tests/responses-stored-method-errors.test.ts	✅ Passed	469ms
tests/retry-behavior.test.ts	✅ Passed	3.08s
tests/sdk-error-shape.test.ts	✅ Passed	237ms

View OkTest run #32081607954

_{SDK merge (363428281513) · head (eec875452cbb) · base (6577709190ae) · OkTest (7e7850017529)}

[jbeckwith-oai]

Reviewed exact head eec875452cbb7ffa93d683a1b46f0dd94d42a4ce in two independent passes.

The existing advanced CodeQL workflow correctly adds merge_group: checks_requested and disables persisted checkout credentials. Event/ref semantics, fork handling, SARIF uploads, action pins, token permissions, current merge-queue rules, and coexistence with the separate dynamic analysis are sound. All substantive exact-head checks passed.

No findings. After deployment, observe one successful real merge-group scan before considering any separate required-check ruleset change.