PYTHON-5877 Consolidate CodeQL config into drivers-github-tools

[aclark4life]

PYTHON-5877

Blocked on: drivers-github-tools#108 — this PR currently pins to an unmerged commit on that branch (flagged by the code scanning bot). Once #108 merges, this PR needs a follow-up commit to re-pin codeql.yml to the resulting commit on main.

Changes in this PR

Replaces the inline CodeQL analysis steps with a call to the new
mongodb-labs/drivers-github-tools/codeql composite action
(drivers-github-tools#108).

The composite action centralises:

• The pinned github/codeql-action hash (Dependabot updates it in one place for all drivers)
• The checkout, Python setup, init, optional manual build, and analyze steps

The workflow in this repo retains only the repo-specific parts: triggers,
concurrency, matrix, and the paths-ignore config block.

Test Plan

• Pre-commit hooks (Validate GitHub Workflows) passed on commit.
• The CodeQL workflow logic is unchanged — same languages, same build modes, same paths-ignore — only the location of the steps moved.
• No unit tests needed for a CI config change.

Checklist

Checklist for Author

• Did you update the changelog (if necessary)?
• Is there test coverage?
• Is any followup work tracked in a JIRA ticket? If so, add link(s).

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

[aclark4life]

Confirmed, this is a real finding. The pinned commit 6916a008ec612b4575d8f630c6745e776207e30a is not on main of mongodb-labs/drivers-github-tools — it's from the still-open, unmerged mongodb-labs/drivers-github-tools#108 (branch PYTHON-5877). Once that PR merges, I'll update this pin to the resulting commit on main (note: if it's squash-merged, the SHA will change from what's currently on the branch).

[Copilot]

Pull request overview

This PR updates the repository’s CodeQL GitHub Actions workflow to delegate the CodeQL scanning steps to the shared mongodb-labs/drivers-github-tools/codeql composite action, keeping only repository-specific configuration (triggers, matrix, concurrency, and paths-ignore) in this repo.

Changes:

• Replaced the inline checkout / setup-python / CodeQL init+analyze steps with a single call to mongodb-labs/drivers-github-tools/codeql pinned by SHA.
• Updated the workflow inputs passed to CodeQL from languages to language, and moved the checkout ref into the composite action inputs.
• Preserved the existing matrix and paths-ignore config block in this repo’s workflow.

[aclark4life]

Companion to mongodb-labs/drivers-github-tools#108

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!