Add CodeQL analysis workflow

[jarlungoodoo73]

This workflow file sets up CodeQL analysis for the repository, specifying triggers for pushes and pull requests to the master branch, as well as a scheduled run. It defines a matrix of languages to analyze and includes steps for initializing CodeQL and performing the analysis.

PR Summary

PR Context

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge. If this PR is a work in progress, please open this as a Draft Pull Request and mark it as Ready to Review when it is ready to merge.
• Breaking changes
  • None
  • OR
  • Experimental feature(s) needed
    • Experimental feature name(s):
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed

Summary by Sourcery

Enable scheduled and change-triggered CodeQL security scanning for the repository.

New Features:

• Add automated CodeQL security analysis for GitHub Actions and C# code.

CI:

• Run CodeQL scans on pushes and pull requests targeting master, with an additional scheduled weekly analysis.

[sourcery-ai]

Reviewer's Guide

Introduces an advanced CodeQL workflow for GitHub Actions and C# security analysis on master changes and a weekly schedule, using matrix-based setup and GitHub’s CodeQL actions to report findings.

Sequence diagram for the CodeQL analysis workflow

sequenceDiagram
    participant GitHub
    participant Workflow as CodeQL_Workflow
    participant Runner
    participant CodeQL
    participant Security as Security_Events

    GitHub->>Workflow: trigger push/pull_request on master
    GitHub->>Workflow: trigger scheduled run
    Workflow->>Runner: create analyze job per matrix.language
    Runner->>Runner: actions/checkout@v7
    Runner->>CodeQL: github/codeql-action/init@v4
    CodeQL-->>Runner: initialize language database
    Runner->>CodeQL: github/codeql-action/analyze@v4
    CodeQL->>Security: upload analysis findings

Loading

File-Level Changes

Change	Details	Files
Add a GitHub Actions workflow that runs scheduled and change-triggered CodeQL scans.	Trigger scans on pushes and pull requests targeting master, plus a weekly cron schedule. Analyze GitHub Actions and C# code through a non-failing language matrix. Grant the workflow permissions required to publish security findings and access repository/package content. Check out the repository, initialize CodeQL, and publish per-language analysis results using CodeQL Action v4.	.github/workflows/codeql.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Copilot]

🟡 Changes recommended

The added workflow YAML has indentation issues that make it invalid and likely to fail to run as-is.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a GitHub Actions workflow to enable CodeQL code scanning for this repository, running on pushes/PRs to master and on a scheduled basis.

Changes:

• Introduces .github/workflows/codeql.yml to run CodeQL Advanced analysis.
• Configures a language matrix (Actions + C#) and scheduled execution.

File summaries

File	Description
.github/workflows/codeql.yml	Adds CodeQL workflow configuration (triggers, matrix languages, init/analyze steps).

Review details

Suppressed comments (1)

.github/workflows/codeql.yml:60

• The steps: section is not properly indented (the - name: entries must be nested under steps:), which will prevent the workflow from running. Also, the repo uses actions/checkout@v4 elsewhere; @v7 is likely invalid and should be aligned to the supported version.

    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/codeql.yml" line_range="60" />
<code_context>
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
</code_context>
<issue_to_address>
**issue (bug_risk):** The workflow references unavailable action versions: `actions/checkout@v7` and `github/codeql-action/*@v4`. GitHub cannot resolve these action refs, so every analysis job fails before CodeQL results are produced.

**Suggested fix:** Use published, repository-supported action versions, preferably the same pinned `actions/checkout` and `github/codeql-action` revisions used by `analyze-reusable.yml`.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and this adds a scheduled and pull-request security workflow that grants its third-party CodeQL and checkout actions permission to write security events and read packages. If misconfigured or compromised, it could produce misleading scan results or consume CI resources; reverting stops future runs, while past alerts or workflow runs may need cleanup.

Blocking findings: .github/workflows/codeql.yml:60

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}