ci(security): strengthen static analysis checks

[Ahoo-Wang]

Goal

Strengthen the project's static-analysis and dependency security gates based on the verified Kaicode evaluation findings. CI should report violations without modifying source files, preserve exception context, and add SAST and pull-request dependency review coverage.

Changes

• Disable Detekt auto-correction globally and explicitly run CI with --no-auto-correct.
• Enable the low-noise ProtectedMemberInFinalClass, UnnecessaryAbstractClass, SwallowedException, and ThrowingExceptionsWithoutMessageOrCause rules while leaving the previously identified high-noise rules disabled.
• Preserve the constructor lookup failure as the cause of IllegalStateException, and document the intentional unknown-event fallback to JsonDomainEvent.
• Add CodeQL analysis for Java and Kotlin on pull requests, pushes to main, a weekly schedule, and manual dispatch.
• Add Dependency Review for pull requests, failing on newly introduced high or critical vulnerabilities.
• Apply least-privilege workflow permissions and pin third-party actions to immutable commit SHAs.

Verification

• ./gradlew :wow-core:test --tests "me.ahoo.wow.modeling.annotation.AggregateMetadataParserTest" --tests "me.ahoo.wow.serialization.JsonSerializerPolymorphicTest" --no-daemon — passed.
• ./gradlew detekt --no-auto-correct --stacktrace --no-daemon — passed across 31 Detekt tasks.
• ./gradlew classes --no-daemon — passed across 81 tasks and validates the CodeQL manual build command.
• Parsed the three changed workflow YAML files with Ruby Psych — passed.
• git diff --check — passed.

Risks and Notes

• The new GitHub workflows require their first remote run before CodeQL upload and Dependency Review behavior can be confirmed end to end.
• GitHub reported 20 existing Dependabot alerts on the default branch during push (1 high, 16 moderate, and 3 low). This PR gates newly introduced high/critical dependency vulnerabilities; it does not remediate existing alerts.
• No public API or persistence contract changes are introduced.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.48%. Comparing base (b53c957) to head (1fb6e28).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #2789   +/-   ##
=========================================
  Coverage     93.48%   93.48%           
  Complexity     5731     5731           
=========================================
  Files           918      918           
  Lines         21874    21875    +1     
  Branches       2020     2020           
=========================================
+ Hits          20449    20450    +1     
  Misses          801      801           
  Partials        624      624           

Flag	Coverage Δ
contract	51.40% <0.00%> (?)
integration	76.33% <ø> (?)
local	86.70% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1fb6e28e30

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Disable persisted checkout credentials before PR builds

For same-repository pull_request runs where the requested token permissions are granted, this checkout happens before running PR-controlled Gradle code while the job has security-events: write; actions/checkout persists the token in local git config by default, so a malicious build script can read and reuse that credential before the CodeQL upload. Set persist-credentials: false here unless the build actually needs authenticated git operations.

Useful? React with 👍 / 👎.