ci: add CodeQL static analysis

Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>

Author: joshua-temple

.github/workflows/codeql.yml

@@ -0,0 +1,77 @@
+name: CodeQL
+
+# Static analysis (SAST) over the Go sources. Runs on every PR and on pushes to
+# the default branch, plus a weekly scheduled scan so newly published query
+# packs catch existing code. Results land in the code-scanning dashboard.
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '24 6 * * 1'
+
+# Read-only by default; the analyze job opts into security-events:write.
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (Go)
+    runs-on: ubuntu-latest
+    permissions:
+      # Required to upload CodeQL results to the code-scanning dashboard.
+      security-events: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      # cache: false is deliberate. CodeQL's Go extractor only sees code that is
+      # actually compiled while it traces the build; a warm build cache (shared
+      # with the other CI jobs) would make `go build` a no-op and yield "no source
+      # code seen during build". Starting cold guarantees real compilation.
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.26.4"
+          cache: false
+
+      # Go does not support build-mode: none, so extraction is traced through a
+      # real build. There is no root module to build and the SDK-backed sink
+      # destinations live outside the workspace, so the manual build walks the
+      # in-workspace modules (the same set ci.yml lints and tests) and compiles
+      # each under the CodeQL tracer.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@d77b13a0df3134d64a457ea9003f600b09fa1c8a # v3.36.1
+        with:
+          languages: go
+          build-mode: manual
+
+      - name: Build (CodeQL tracing)
+        shell: bash
+        env:
+          MODULES: "state state/expr durable cluster transport wasm e2e examples/fooddelivery examples/dispatch telemetry telemetry/slog telemetry/otel telemetry/datadog sink sink/bridge sink/file sink/http sink/prometheus sink/slog"
+        run: |
+          # Force a cold build cache so every package is recompiled under the
+          # CodeQL tracer (otherwise nothing is extracted; see cache: false above).
+          go clean -cache
+          # Build from inside each module dir (cd, not `go build -C`): the
+          # extractor traces the in-process compiles, and `-C` re-execs the go
+          # command in a way the tracer does not follow, which yields an empty
+          # database ("no source code seen during build").
+          for module in $MODULES; do
+            echo "::group::build ($module)"
+            ( cd "$module" && go build ./... )
+            echo "::endgroup::"
+          done
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@d77b13a0df3134d64a457ea9003f600b09fa1c8a # v3.36.1
+        with:
+          category: "/language:go"