[codeql] Collect statistics weekly (#193308)

Moves stats collection from after the analyze scan to a weekly cron.

.github/CODEOWNERS

@@ -1361,6 +1361,7 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 # Kibana Platform Security
 /.github/codeql @elastic/kibana-security
 /.github/workflows/codeql.yml @elastic/kibana-security
+/.github/workflows/codeql-stats.yml @elastic/kibana-security
 /src/dev/eslint/security_eslint_rule_tests.ts @elastic/kibana-security
 /src/core/server/integration_tests/config/check_dynamic_config.test.ts @elastic/kibana-security
 /src/plugins/telemetry/server/config/telemetry_labels.ts @elastic/kibana-security

.github/workflows/codeql-stats.yml

@@ -0,0 +1,28 @@
+name: CodeQL statistics
+
+on:
+  schedule:
+    - cron: '27 0 * * 1' # At 00:27 every Monday
+
+jobs:
+  stats:
+    name: CodeQL statistics
+    runs-on: ubuntu-latest
+    if: github.repository == 'elastic/kibana' # Hack: Do not run on forks
+    steps:
+    - name: Checkout kibana-operations
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      with:
+        repository: 'elastic/kibana-operations'
+        ref: main
+        path: ./kibana-operations
+        token: ${{secrets.KIBANAMACHINE_TOKEN}}
+
+    - name: CodeQL alert statistics
+      working-directory: ./kibana-operations/triage
+      env:
+        GITHUB_TOKEN: ${{secrets.KIBANAMACHINE_TOKEN}}
+        SLACK_TOKEN: ${{secrets.CODE_SCANNING_SLACK_TOKEN}}
+      run: |
+        npm ci --omit=dev
+        node codeql-alert-stats

.github/workflows/codeql.yml

@@ -76,12 +76,3 @@ jobs:
       run: |
         npm ci --omit=dev
         node codeql-alert 
-
-    - name: CodeQL alert statistics
-      working-directory: ./kibana-operations/triage
-      env:
-        GITHUB_TOKEN: ${{secrets.KIBANAMACHINE_TOKEN}}
-        SLACK_TOKEN: ${{secrets.CODE_SCANNING_SLACK_TOKEN}}
-      run: |
-        npm ci --omit=dev
-        node codeql-alert-stats