`codeql.yml` does not check `dependency-updates` - caused a CI break on the PR to main

[david-allison]

• failing: Dependency updates 20251220 #19869

Caused by: com.semmle.extractor.java.interceptors.KotlinInterceptor$KotlinVersionTooRecentError: Kotlin version 2.3.0 is too recent. CodeQL currently supports versions below 2.2.30

Due to:

Anki-Android/.github/workflows/codeql.yml

Lines 14 to 21 in 64e5a83

	on:
	workflow_dispatch:
	push:
	branches: [ "main", "*release*" ]
	pull_request:
	branches: [ "main", "*release*" ]
	schedule:
	- cron: '42 12 * * 1'

• https://redirect.github.com/github/codeql/issues/20661

@mikehardy - is there a feasible path to only check when the kotlin version is bumped?

[mikehardy]

@david-allison I must admit I don't understand the question but looks like codeql has a pr in review to support kotlin 2.3.0 so this will self resolve

[david-allison]

Right now, codeql doesn't run on PRs from dependabot to the dependency-updates branch, only from our dependency-updates to main PR which we manually create.

Is it feasible to also have the dependabot 'Kotlin Bump' PRs trigger CodeQL, without the other dependabot PRs doing so?

If not, should we run CodeQL on all dependencies PRs, or leave it as it is, and handle the occasional flakes?

[mikehardy]

as long as it gates things on main I'm okay with the occasional flakes unless they become more frequent than "once"