[li041]

Summary

• Add a GitHub Actions workflow for automated CodeQL security analysis.
• Run CodeQL analysis on pushes and pull requests targeting dev and main.
• Schedule a weekly scan to detect potential security issues introduced by ongoing development.

Motivation

Introduce automated static application security testing (SAST) to help identify potential security vulnerabilities and code quality issues in the repository.

CodeQL provides continuous security analysis without requiring changes to the existing development workflow.

Verification

• no verification, use default configuration recommended by CodeQL

Risks and Limitations

• CodeQL findings depend on the supported queries and analysis capabilities of each language.
• The current configuration uses build-mode: none for all languages. Analysis may have limitations for code that depends on generated sources, complex build configurations, or conditional compilation.
• CodeQL is a static analysis tool and does not replace dependency vulnerability scanning, secret scanning, or manual security reviews.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[agicy]

LGTM.