Should the CodeQL scan be a required check? #1674

We're adding a .github/required-checks.yml file to each track, which lists the checks that must pass before a PR can merge into main. Changes to it are synced to the repo's branch protection automatically. exercism/ruby#1871 shows how it works.

For TypeScript, we plan to require these:

• configlet / configlet
• i18n / completeness
• impersonate
• precheck
• verify

This repo also runs a CodeQL scan (analyze (javascript)) on PRs. Should that be required too? If it is, a PR can't merge until the scan passes, so a new CodeQL finding would block merging until someone deals with it.

Let us know which you'd prefer, and we'll set the list up to match.

🤖 Generated with Claude Code