ci: add codeql workflow (#2085)

Signed-off-by: exploreriii <133720349+exploreriii@users.noreply.github.com>

Author: exploreriii

.github/workflows/codeql.yml

@@ -0,0 +1,68 @@
+name: "CodeQL Advanced"
+
+on:
+    push:
+        branches: ["main"]
+    pull_request:
+        branches: ["main"]
+        paths-ignore:
+            - "**/*.md"
+    schedule:
+        - cron: "28 23 * * *" # Runs every day at 23:28 UTC.
+
+jobs:
+    analyze:
+        name: Analyze (${{ matrix.language }})
+        runs-on: hl-sdk-py-lin-md
+        permissions:
+            contents: read
+            # required for all workflows
+            security-events: write
+            # required to fetch internal or private CodeQL packs
+            packages: read
+
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                    - language: actions
+                      build-mode: none
+                    - language: python
+                      build-mode: none
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+            - name: Harden the runner (Audit all outbound calls)
+              uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+              with:
+                  egress-policy: audit
+
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.3.5
+              with:
+                  languages: ${{ matrix.language }}
+                  build-mode: ${{ matrix.build-mode }}
+                  queries: security-extended
+                  dependency-caching: true
+
+            - name: Set up Python
+              if: matrix.language == 'python'
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+              with:
+                  python-version: "3.13"
+
+            - name: Install uv
+              if: matrix.language == 'python'
+              uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+              with:
+                  enable-cache: true
+
+            - name: Install dependencies
+              if: matrix.language == 'python'
+              run: uv sync --all-extras --dev
+
+            - name: Perform CodeQL Analysis
+              uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.3.5
+              with:
+                  category: "/language:${{matrix.language}}"

CHANGELOG.md

@@ -25,6 +25,7 @@ This changelog is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.
 - chore: update GitHub Actions runners from ubuntu-latest to hl-sdk-py-lin-md (#2021)
 - Refactored the Advanced Issue Template to V2 with stricter prerequisites and a focus on architectural design (#2016).
 - Refactored the Advanced Issue Template to ensure PR-level quality checklists do not block maintainers during issue creation (#2036)
+- Added CodeQL workflow (#2084)
 - chore: add concurrency to unit and integration tests (#2071)
 - Add automated label sync workflow to propagate labels from linked issues to pull requests (#1716)
 - chore: update spam list (#2035)