Add and validate CodeQL scanning

.github/scripts/codeql-workflow-policy.test.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+
+const workflowPath = new URL("../workflows/codeql.yml", import.meta.url);
+const workflow = readFileSync(workflowPath, "utf8");
+
+test("uses current CodeQL language identifiers and build-free extraction", () => {
+  assert.match(workflow, /language: \[ 'c-cpp', 'csharp' \]/);
+  assert.match(workflow, /build-mode: none/);
+  assert.doesNotMatch(workflow, /language: \[ 'cpp'/);
+  assert.doesNotMatch(workflow, /build-mode: manual/);
+});
+
+test("does not duplicate the repositories' language build pipelines", () => {
+  assert.doesNotMatch(workflow, /apt-get/);
+  assert.doesNotMatch(workflow, /dotnet (?:restore|build)/);
+  assert.doesNotMatch(workflow, /cmake/);
+});
+
+test("uses action versions backed by the current Node runtime", () => {
+  assert.match(workflow, /actions\/checkout@v7/);
+  assert.match(workflow, /github\/codeql-action\/init@v4/);
+  assert.match(workflow, /github\/codeql-action\/analyze@v4/);
+  assert.doesNotMatch(workflow, /actions\/setup-dotnet@/);
+});
+
+test("pins the runner and disables persisted checkout credentials", () => {
+  assert.match(workflow, /runs-on: ubuntu-24\.04/);
+  assert.doesNotMatch(workflow, /runs-on: ubuntu-latest/);
+  assert.match(workflow, /persist-credentials: false/);
+});
+
+test("prevents checkout's default-branch warning", () => {
+  assert.match(workflow, /GIT_CONFIG_COUNT: '1'/);
+  assert.match(workflow, /GIT_CONFIG_KEY_0: init\.defaultBranch/);
+  assert.match(workflow, /GIT_CONFIG_VALUE_0: main/);
+});

.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '43 3 * * 0'
+
+env:
+  GIT_CONFIG_COUNT: '1'
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: main
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'c-cpp', 'csharp' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: none
+        queries: security-extended,security-and-quality
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{ matrix.language }}"

README.md

@@ -2,6 +2,7 @@
 
 [![Codacy Badge](https://api.codacy.com/project/badge/Grade/93857535a2214ba9b512e1a88787d461)](https://app.codacy.com/gh/linksplatform/Interfaces?utm_source=github.com&utm_medium=referral&utm_content=linksplatform/Interfaces&utm_campaign=Badge_Grade_Settings)
 [![CodeFactor](https://www.codefactor.io/repository/github/linksplatform/interfaces/badge)](https://www.codefactor.io/repository/github/linksplatform/interfaces)
+[![CodeQL](https://github.com/linksplatform/Interfaces/actions/workflows/codeql.yml/badge.svg)](https://github.com/linksplatform/Interfaces/actions/workflows/codeql.yml)
 
 | [![Actions Status](https://github.com/linksplatform/Interfaces/workflows/Test%20cpp/badge.svg)](https://github.com/linksplatform/Interfaces/actions?workflow=Test%20cpp) | [![NuGet Version and Downloads count](https://img.shields.io/nuget/v/Platform.Interfaces.TemplateLibrary?label=nuget&style=flat)](https://www.nuget.org/packages/Platform.Interfaces.TemplateLibrary) [![ConanCenter package](https://repology.org/badge/version-for-repo/conancenter/platform.interfaces.svg)](https://conan.io/center/platform.interfaces) | __C++__  |
 |-|-|-|