Add CodeQL query to detect unclosed Repository and Storage instances

[AriehSchneier]

Summary

Implements static analysis to detect resource leaks in go-git usage where Repository or Storage instances are created but never closed. This provides compile-time detection of file handle leaks as an alternative to runtime leak detection.

What's included

CodeQL Query (codeql/queries/unclosed-resources.ql)

Detects patterns where resources are created but not closed:

• Repository creation via PlainOpen, Init, Clone, and related functions
• Storage creation via NewStorage and NewStorageWithOptions
• Submodule and worktree operations that return repositories
• Missing Close() calls or defer cleanup patterns

The query excludes false positives by ignoring:

• Resources stored in fields (managed elsewhere)
• Resources returned to caller (caller's responsibility)

CodeQL Configuration (codeql/codeql-config.yml, codeql/qlpack.yml)

• Package definition for the CodeQL query pack
• Configuration file that references the custom query

GitHub Actions Workflow (.github/workflows/codeql.yml)

• Runs automatically on pushes, PRs, and weekly schedule
• Can be manually triggered with custom go-git branch/ref for testing
• Uses latest actions: actions/checkout@v6.0.2 and codeql-action@v4.35.3
• Analyzes go-git repository with the custom queries from this repo

Documentation (codeql/README.md)

• Explains what the query detects
• Provides good/bad examples
• Documents how to run queries locally and in CI

Benefits

✅ Catches resource leaks at code review time, not test time
✅ No build tags or test infrastructure needed
✅ Works on all code, not just test code
✅ No runtime overhead
✅ Helps enforce best practices across the ecosystem

Test plan

• Verify CodeQL query syntax is valid
• Test workflow runs successfully
• Manually trigger workflow against a go-git branch with known leaks
• Confirm query detects the expected issues

🤖 Generated with Claude Code

[pjbgf]

@AriehSchneier Thanks for working on this. 🙇