Add CodeQL workflow for automated code analysis

[kriuchkov]

No description provided.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to run CodeQL static analysis for the repository, complementing the existing CI build workflow.

Changes:

• Introduces a .github/workflows/codeql.yml workflow that initializes CodeQL for cpp, runs an autobuild, and uploads analysis results.
• Configures triggers for push, pull request, and a weekly scheduled run.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

steps: is followed by list items (- name: ...) that are not indented under the steps key. This makes the workflow YAML invalid and GitHub Actions will fail to parse it. Indent all step entries so the - lines are nested under steps: (consistent with .github/workflows/build.yml).

Suggested change

	- name: Checkout repository
	uses: actions/checkout@v4
	# Initializes the CodeQL tools for scanning.
	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: ${{ matrix.language }}
	# If you wish to specify custom queries, you can do so here or in a config file.
	# By default, queries listed here will override any specified in a config file.
	# Prefix the list here with "+" to use these queries and those in the config file.
	# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
	# If this step fails, then you should remove it and run the build manually (see below)
	- name: Autobuild
	uses: github/codeql-action/autobuild@v3
	# ℹ️ Command-line programs to run using the OS shell.
	# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
	# If the Autobuild fails above, remove it and uncomment the following three lines.
	# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
	# - run: |
	# echo "Run, Build Application using script"
	# ./location_of_script_within_repo/buildscript.sh
	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:${{matrix.language}}"
	- name: Checkout repository
	uses: actions/checkout@v4
	# Initializes the CodeQL tools for scanning.
	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: ${{ matrix.language }}
	# If you wish to specify custom queries, you can do so here or in a config file.
	# By default, queries listed here will override any specified in a config file.
	# Prefix the list here with "+" to use these queries and those in the config file.
	# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
	# If this step fails, then you should remove it and run the build manually (see below)
	- name: Autobuild
	uses: github/codeql-action/autobuild@v3
	# ℹ️ Command-line programs to run using the OS shell.
	# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
	# If the Autobuild fails above, remove it and uncomment the following three lines.
	# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
	# - run: |
	# echo "Run, Build Application using script"
	# ./location_of_script_within_repo/buildscript.sh
	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:${{matrix.language}}"

[Copilot]

This workflow triggers on pushes to master, but the repo's existing CI workflow (.github/workflows/build.yml) uses main. If the default branch is main, CodeQL will never run on push events. Update the branch filter to main (and consider aligning the pull_request branch filter as well).

Suggested change

	branches: [ "master" ]
	pull_request:
	branches: [ "**" ]
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]