should we keep codeql in every push to pull requests & main?

[jeromedockes]

We have a workflow running github's codeQL which apparently does:

semantic code analysis engine, CodeQL, against a repository's source code to find security vulnerabilities

(I haven't looked at it in depth)
scikit-learn, scipy, polars, joblib, pytest, arrow, cloudpickle, cryptography, flask don't seem to use it but apparently numpy, pandas, and matplotib do

it is one of the checks that take a long time in the CI; maybe we can remove it or at least run it only with a scheduled job and not every push to a PR branch or main?

[Vincent-Maladiere]

I'm +1 to remove it for now and think about scheduling later.

[Vincent-Maladiere]

Close by removing CodeQL