ci: Set up CodeQL analysis w/ fix (#276)

* ci: Set up CodeQL analysis
* chore(ql): resolve js/unused-local-variable
* ci(codeql): ignore generated cordova.js

.github/workflows/ci.yml

@@ -43,11 +43,27 @@ jobs:
           node --version
           npm --version
 
+      # "bin/templates/platform_www/cordova.js" is ignored because it is a generated file.
+      # It contains mixed content from the npm package "cordova-js" and "./cordova-js-src".
+      # The report might not be resolvable because of the external package.
+      # If the report is related to this repository, it would be detected when scanning "./cordova-js-src".
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+          queries: security-and-quality
+          config: |
+            paths-ignore:
+              - coverage
+              - node_modules
+              - bin/templates/platform_www/cordova.js
+
       - name: npm install and test
         run: npm cit
         env:
           CI: true
 
+      - uses: github/codeql-action/analyze@v3
+
       - uses: codecov/codecov-action@v4
         if: success()
         with:

tests/spec/fixtures/test-app-with-electron-plugin/plugins/cordova-plugin-sample/src/electron/index.js

@@ -18,7 +18,6 @@
 */
 
 const { system, osInfo } = require('systeminformation');
-const electron = require
 
 module.exports = {
     getSampleInfo: async () => {

tests/spec/fixtures/test-app-with-electron-plugin/plugins/cordova-plugin-sample/www/sample.js

@@ -22,7 +22,6 @@
 var argscheck = require('cordova/argscheck');
 var channel = require('cordova/channel');
 var exec = require('cordova/exec');
-var cordova = require('cordova');
 
 channel.createSticky('onCordovaInfoReady');
 // Tell cordova channel to wait on the CordovaInfoReady event