CodeQL Security Analysis #19

	name: CodeQL Security Analysis

	on:
	schedule:
	# Weekly scan: Sundays at 4 AM UTC
	- cron: '0 4 * * 0'
	workflow_call:

	permissions:
	contents: read
	security-events: write

	jobs:
	analyze:
	name: CodeQL Analysis
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	actions: read

	strategy:
	fail-fast: false
	matrix:
	# Repository contains GitHub Actions workflows, PowerShell, and shell scripts
	# CodeQL supports 'actions' for workflow security scanning
	language: [ 'actions' ]

	steps:
	- name: Checkout repository
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.2.2
	with:
	persist-credentials: false

	- name: Initialize CodeQL
	uses: github/codeql-action/init@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
	with:
	languages: ${{ matrix.language }}
	queries: security-extended,security-and-quality

	- name: Autobuild
	uses: github/codeql-action/autobuild@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0
	with:
	category: "/language:${{ matrix.language }}"

	- name: Add job summary
	if: always()
	run: \|
	echo "## CodeQL Security Analysis Complete" >> $GITHUB_STEP_SUMMARY
	echo "Language: ${{ matrix.language }}" >> $GITHUB_STEP_SUMMARY
	echo "Queries: security-extended, security-and-quality" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY
	echo "📊 View results in the Security tab under Code Scanning" >> $GITHUB_STEP_SUMMARY

Provide feedback