Add CI: build/test, CodeQL and zizmor workflows

- build.yml: set up JDK 17 + maven cache, run `mvn verify` (now runs the tests).
- codeql.yml: CodeQL static analysis for the Java sources.
- zizmor.yml: audit the GitHub Actions workflows for security issues, results
  uploaded to code scanning.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nilsbehlen

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time
+# Build the project and run the test suite with Maven.
 
 name: Build
 
@@ -8,13 +8,24 @@ on:
   pull_request:
     branches: [ "master" ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
 
-    - name: Build with Maven
-      run: mvn -B package --file pom.xml
+      # 'verify' runs the unit tests (surefire) before packaging. Tests run by
+      # default now; they can be skipped locally with -DskipTests.
+      - name: Build and test with Maven
+        run: mvn -B verify --file pom.xml

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+# CodeQL static analysis for the Java sources.
+# Results appear under the repository's "Security > Code scanning" tab.
+
+name: CodeQL
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    # Weekly run so new CodeQL queries are applied to unchanged code too.
+    - cron: '27 4 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (java)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: java-kotlin
+          build-mode: manual
+
+      - name: Set up JDK
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      # Manual build so CodeQL traces the exact compilation. Skip tests to keep the analysis build fast.
+      - name: Build
+        run: mvn -B -DskipTests package --file pom.xml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:java-kotlin"

.github/workflows/zizmor.yml

@@ -0,0 +1,41 @@
+# zizmor audits the GitHub Actions workflows themselves for security issues
+# (injection, excessive permissions, unpinned actions, etc.).
+# Results appear under the repository's "Security > Code scanning" tab.
+
+name: zizmor
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      # Audit all workflow files. continue-on-error so findings still get uploaded
+      # to code scanning instead of aborting before the upload step.
+      - name: Run zizmor
+        continue-on-error: true
+        run: uvx zizmor --format sarif . > zizmor.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: zizmor.sarif
+          category: zizmor