From 7cc79d364aa3b76223108faecda050b631ab530a Mon Sep 17 00:00:00 2001
From: Moustafa Farhat <38836727+moustafarhat@users.noreply.github.com>
Date: Sun, 27 Sep 2026 22:38:59 +0200
Subject: [PATCH] Add CodeQL code scanning for Python and Actions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..3e554ce
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,27 @@
+name: CodeQL
+
+# Standard CodeQL code scanning for the Python scripts and the GitHub Actions workflows.
+# Results appear under Security -> Code scanning. Free on public repos; the `if:` guard skips
+# it (instead of failing) if the repo is ever made private without Advanced Security.
+on:
+  push: { branches: [main] }
+  pull_request:
+  schedule: [{ cron: "0 6 * * 1" }]
+  workflow_dispatch:
+
+permissions: { contents: read, security-events: write }
+
+jobs:
+  analyze:
+    if: ${{ !github.event.repository.private }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, actions]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with: { languages: "${{ matrix.language }}", build-mode: none }
+      - uses: github/codeql-action/analyze@v4
+        with: { category: "/language:${{ matrix.language }}" }