Adds the two workflows needed to close the gap identified while
reviewing PR #118 (codeql pack upgrade weekly cron):

- detect-codeql-release.yml: weekly (+ workflow_dispatch) tripwire that
  compares .codeqlversion against github/codeql-cli-binaries' latest
  release and keeps a single tracking issue open/updated while behind,
  auto-closing it once caught up. Never opens a PR itself.
- update-codeql-version.yml: workflow_dispatch with a codeql_version
  input. Bumps .codeqlversion, runs codeql pack upgrade <dir> for
  every pack, and opens a PR via the same GitHub App token pattern as
  update-release.yml so CI actually runs on it (a GITHUB_TOKEN-authored
  PR would not trigger downstream workflows).

Together these cover detection + mechanical dependency refresh; fixing
compile/test breakage from upstream API changes and bumping each pack's
own version: still needs a human (or delegated Copilot coding agent) -
documented as a 3-step process in CONTRIBUTING.md.

Rewrites CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library
version" section to describe this new process and adds reference-style
links for both new workflows and codeql-cli-binaries.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…+ docs (#160)

* feat(publish): add publish-summary table + GitHub Release upsert

publish.yml now records a per-pack JSON result fragment (published /
up-to-date / failed) from each of the 4 jobs' matrix entries, uploads them
as artifacts, and a new summary job downloads and merges them into a
unified markdown table (languages x pack types) that is:
  1. written to the Actions run summary ($GITHUB_STEP_SUMMARY)
  2. upserted into the matching GitHub Release body (.release.yml's
     version -> vX.Y.Z tag), inside marker comments so "What's Changed"
     and other release content is preserved across runs

New scripts:
  - .github/scripts/build-publish-summary.sh
  - .github/scripts/upsert-release-table.sh

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(publish): avoid tee+pipe fragility in Build summary table step

The previous form piped the script's stdout through tee and redirected
tee's own stdout (not the file write) into GITHUB_STEP_SUMMARY. Combined
with 'bash -e' (no pipefail) at the step level, this masked failures and
produced an empty summary.md in a real run, upserting empty
publish-summary markers into the v0.2.2 release. Switch to plain
sequential redirects and add debug output (fragment listing, line/byte
counts) to make future failures visible in the step log.

* feat(publish): gate auto-publish on .release.yml changes; document release process

- publish.yml's push trigger now only fires when .release.yml changes
  (paths filter), not on every push to main. workflow_dispatch remains
  as the manual escape hatch for one-off hotfix publishes.
- Rewrite CONTRIBUTING.md's Releases & publishing section to match:
  shipping a pack change now just stages it until the next release cut
  or a manual dispatch; add a Cutting a release walkthrough for
  update-release.yml/patch-release-me now that .release.yml's CodeQL
  Pack Versions location (#158) actually drives every pack's version;
  document the -alpha.N + workflow_dispatch hotfix convention and note
  #155 as an accepted one-off exception; note #159 as the recovery
  path if .release.yml's version is ever hand-edited directly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: address Copilot review feedback on PR #160

- Anchor CURRENT_VERSION extraction to '^version:' (with head -1) in all
  four publish.yml jobs so a stray 'version' substring elsewhere in a
  qlpack.yml (e.g. a comment) can't be matched instead of the real field.
- upsert-release-table.sh: only take the in-place marker-replacement path
  when BOTH the start and end marker are present in the existing release
  body; otherwise append, so a corrupted/partial marker pair can't cause
  the awk script to silently truncate the rest of the release notes.
- CONTRIBUTING.md: grammar fix (find/replaces -> finds and replaces).

Verified gh release create --notes-file + --generate-notes together is
NOT mutually exclusive in gh 2.96.0 (contrary to a review comment) --
confirmed empirically: the v0.2.3 release this script created has both
the publish-summary table (from --notes-file) and the auto-generated
'What's Changed' changelog (from --generate-notes) in its body.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* feat(publish): add CodeQL standard library versions cross-check table

Every publish.yml run now builds and upserts a second table into the
matching GitHub Release: for each language, the locked codeql/<lang>-all
version (from lib/codeql-pack.lock.yml) versus the version github/codeql
itself bundles with the pinned CodeQL CLI (.codeqlversion), read from its
own <lang>/ql/lib/qlpack.yml at tag codeql-cli/v<version>. Mismatches are
flagged with an actions warning annotation and a table marker, giving a
machine-checkable tripwire for the drift risk documented in CONTRIBUTING.md
(CI's 'codeql pack install' step is non-resolving, so a forgotten
'codeql pack upgrade <dir>' after a .codeqlversion bump silently pins a
language to a stale library version forever).

- Add .github/scripts/build-codeql-lib-versions-table.sh
- Parameterize upsert-release-table.sh with an optional block-name arg so
  multiple independent marker-comment blocks can coexist in one release
  body without clobbering each other
- Wire both into publish.yml's summary job
- Document the new table and cross-check in CONTRIBUTING.md

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix: mark build-codeql-lib-versions-table.sh executable

git-created file lost the exec bit, causing publish.yml's new step to
fail with 'Permission denied' (exit 126).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(build-codeql-lib-versions-table): check src lock file, not lib

CONTRIBUTING.md's 'Supported CodeQL versions' table already documents
<language>/src/codeql-pack.lock.yml as the source-of-truth lock file (the
queries pack CI actually compiles/tests against), not lib. Reading from
lib/codeql-pack.lock.yml instead meant the tripwire could miss drift in
the src lock, or flag drift that didn't actually affect the compiled
queries. Switch the check (and its remediation guidance) to src, per
Copilot review feedback on PR #160.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* feat(publish): commit/tag-anchored links + queries pack in lib-versions table

- Discover direct codeql/* dependencies dynamically from each language's
  src/qlpack.yml instead of hardcoding codeql/<lang>-all, so this also
  covers codeql/<lang>-queries for C++/C# (which additionally depend on
  the upstream standard queries pack).
- Link every "our locked" version to the exact commit/file/line in this
  repo (blob/<GITHUB_SHA>/...#L<n>) and every "upstream" version to the
  exact file/line in github/codeql at the matching codeql-cli/vX tag, so
  each row can be verified with one click instead of trusting the table.
- Rename the section/table to "CodeQL standard library & query pack
  versions" and update CONTRIBUTING.md references accordingly.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* feat: automate CodeQL CLI version bump detection and dependency refresh

Adds the two workflows needed to close the gap identified while
reviewing PR #118 (codeql pack upgrade weekly cron):

- detect-codeql-release.yml: weekly (+ workflow_dispatch) tripwire that
  compares .codeqlversion against github/codeql-cli-binaries' latest
  release and keeps a single tracking issue open/updated while behind,
  auto-closing it once caught up. Never opens a PR itself.
- update-codeql-version.yml: workflow_dispatch with a codeql_version
  input. Bumps .codeqlversion, runs codeql pack upgrade <dir> for
  every pack, and opens a PR via the same GitHub App token pattern as
  update-release.yml so CI actually runs on it (a GITHUB_TOKEN-authored
  PR would not trigger downstream workflows).

Together these cover detection + mechanical dependency refresh; fixing
compile/test breakage from upstream API changes and bumping each pack's
own version: still needs a human (or delegated Copilot coding agent) -
documented as a 3-step process in CONTRIBUTING.md.

Rewrites CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library
version" section to describe this new process and adds reference-style
links for both new workflows and codeql-cli-binaries.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(publish): gate release-table upsert to push trigger, clarify failed-check cell

Two fixes from Copilot review on PR #160:

- publish.yml: only run the "Upsert release table" step on the push
  (release-cut) trigger, not workflow_dispatch. A manual one-off hotfix
  publish (see CONTRIBUTING.md) still points .release.yml at the last
  cut release, so upserting that run's tables into it would overwrite
  an already-published release's notes with a misleading summary of an
  unrelated hotfix run.
- build-publish-summary.sh: when a pack's version-check step itself
  fails, previous_version can be empty/null, which rendered as the
  confusing "publish failed (still ``)". Now shows an explicit
  "previous version unknown" message in that case.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(publish): check both src and lib lock files for CodeQL version drift

src/qlpack.yml and lib/qlpack.yml each declare their own codeql/<lang>-all
dependency and resolve it into their own independent codeql-pack.lock.yml.
Nothing keeps these two lock files in sync automatically - codeql pack
upgrade resolves each pack directory separately, so running it against one
and not the other silently lets them drift. The standard-library-versions
table previously only checked src as a 'coarse signal', which meant a stale
lib lock could go undetected while the table showed all green.

Now checks both src and lib for every language (ext/ext-library-sources are
still out of scope: they pin via extensionTargets, not dependencies, so
CodeQL never resolves a locked version for them). Adds a Pack column to the
table to distinguish rows. Also updates CONTRIBUTING.md's Supported CodeQL
versions section, which similarly implied a single lock file was the source
of truth per language.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* docs: fix publish.yml job count in CONTRIBUTING.md (five jobs, not four)

CONTRIBUTING.md said publish.yml is organized as four jobs, but it also has
a fifth 'summary' job (needs: [queries, library, extensions,
library_sources_extensions], if: always()) that aggregates results into the
publish-summary and CodeQL lib-versions tables and upserts them into the
Release notes. Clarify the doc to describe all five.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(publish): don't fail check_version when a pack's GHCR container doesn't exist yet

All four publish jobs (queries/library/extensions/library_sources_extensions)
read the currently-published version via 'gh api .../versions'. run: steps
default to bash -e, so a 404 (package never published, e.g. a brand-new
language/pack) aborted the step and failed the job before it could ever
publish that pack for the first time.

Move '|| true' inside the command substitution so a fetch failure just
leaves PUBLISHED_VERSION empty (correctly differing from CURRENT_VERSION,
triggering a first publish) instead of killing the step under set -e.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>