Add scoped CodeQL scans for Go, Python and Actions

.github/SECURITY_MAINTENANCE.md

@@ -14,3 +14,17 @@ publishing permissions scoped to the release or Scorecard job that needs them.
 No personal access token or additional GitHub App is needed.
 
 See GitHub's [workflow permission settings](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token).
+
+## CodeQL Workflow
+
+The checked-in CodeQL workflow scans Go, Python examples, and Actions on pull
+requests, main updates, and a weekly schedule. Upload permission belongs only to
+its analysis job.
+
+When switching from GitHub's default setup to this workflow, a maintainer must
+disable **default setup** under **Settings > Advanced Security > CodeQL analysis**,
+then rerun the new workflow and confirm all language results upload. Keep the
+workflow enabled. GitHub rejects advanced-workflow uploads while default setup
+is enabled; see [the migration warning](https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/default-setup-enabled).
+
+This change does not add review requirements or modify repository rulesets.

.github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+# SPDX-License-Identifier: Apache-2.0
+# Code authors: Vijay and Codex
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request: {}
+  schedule:
+    - cron: '41 6 * * 2'
+
+permissions: {}
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: go
+            build-mode: manual
+          - language: python
+            build-mode: none
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26.9'
+          cache: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+      - name: Build Go module
+        if: matrix.language == 'go'
+        env:
+          GOTOOLCHAIN: local
+        run: go build -a -mod=readonly ./...
+      - name: Analyze and upload
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          category: '/language:${{ matrix.language }}'
+          upload: always