feat: [Code Scanning] Security Improvements - create codeql.yml

[monilpat]

Relates to:

[Enable CodeQL Analysis for Security Scanning] (#1313)

Risks

Low – The addition of CodeQL scanning is non-disruptive and will not affect existing application functionality. Minor risks include possible false positives or initial configuration errors, which can be addressed without impact to production workflows.

Background

What does this PR do?

This PR integrates CodeQL Analysis into the GitHub repository to enable automated security scanning of the codebase. CodeQL will analyze code for vulnerabilities, errors, and potential improvements across supported programming languages.

What kind of change is this?

Features – Non-breaking change that adds security functionality.

Why are we doing this?

To improve code security and quality by automating the detection of vulnerabilities and providing actionable insights directly within GitHub. This aligns with best practices for secure DevSecOps workflows.

Documentation changes needed?

My changes do not require a change to the project documentation.

Testing

Where should a reviewer start?

• Review the .github/workflows/codeql-analysis.yml file to verify the CodeQL setup and configuration.
• Check the Security tab for CodeQL scan results after testing the workflow.

Detailed testing steps

1. Trigger the CodeQL workflow by pushing new code or opening a pull request.
2. Verify that the workflow completes successfully.
3. Confirm that the results are displayed under the Security tab of the repository.
4. Address any flagged issues and validate that resolved issues no longer appear in subsequent scans.

Deploy Notes

No special deployment instructions are needed. The workflow is self-contained within the repository configuration.

Database changes

None.

Deployment instructions

Standard GitHub Action setup: merge the PR and ensure the workflow is triggered by future commits or pull requests.

---

This PR provides the foundation for continuous code security scanning using CodeQL and ensures our repository adheres to security best practices.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[shakkernerd]

LGTM! 🚀