Merge master and resolve conflicts

- Retained security improvements from master (token detection, cache prep, safe directory)
- Applied security hardening by pinning actions/checkout@v4 to commit SHA 11bd71901bbe5b1630ceea73d27597364c9af683
- Added persist-credentials: false to checkout step to prevent credential exposure

.github/workflows/code_quality.yml

@@ -9,19 +9,44 @@ on:
 
 jobs:
   qodana:
+    # Use GitHub-hosted runners for PR scans so untrusted code never runs on persistent internal infrastructure.
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      pull-requests: read
+      checks: read
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}  # to check out the actual pull request commit, not the merge commit
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}  # Use PR head when available, otherwise the pushed SHA.
           fetch-depth: 0  # a full history is required for pull request analysis
           persist-credentials: false
+      - name: Mark repository as safe for Git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Prepare Qodana cache directories
+        run: |
+          mkdir -p "${RUNNER_TEMP}/qodana/caches"
+          mkdir -p "${RUNNER_TEMP}/qodana/results"
+      - name: Detect Qodana Cloud token
+        id: qodana-token
+        env:
+          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
+        run: |
+          if [ -n "${QODANA_TOKEN:-}" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: 'Qodana Scan'
-        uses: JetBrains/qodana-action@v2025.3
+        if: ${{ steps.qodana-token.outputs.present == 'true' }}
+        uses: JetBrains/qodana-action@v2026.1
         with:
           pr-mode: false
         env:
           QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
           QODANA_ENDPOINT: 'https://qodana.cloud'
+
+      - name: 'Skip Qodana Scan (missing cloud token)'
+        if: ${{ steps.qodana-token.outputs.present != 'true' }}
+        run: echo "Skipping Qodana because QODANA_TOKEN is not configured."