1 files changed, 53 insertions, 0 deletions
diff --git a/.github/workflows/neozip-codeql.yml b/.github/workflows/neozip-codeql.yml
new file mode 100644
index 0000000000..2bc5f489bd
--- /dev/null
+++ b/.github/workflows/neozip-codeql.yml
@@ -0,0 +1,53 @@
+name: "neozip: CodeQL"
+
+on:
+  workflow_call:
+  workflow_dispatch:
+  schedule:
+    - cron: "27 17 * * 0"
+
+jobs:
+  analyze:
+    name: CodeQL (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          show-progress: 'false'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: cpp
+          queries: +security-and-quality
+
+      - name: Build default config
+        shell: bash
+        run: |
+          cmake -B build-default -S neozip ${{ runner.os == 'Windows' && '-A x64' || '' }}
+          cmake --build build-default -j4
+
+      - name: Build compat config
+        shell: bash
+        run: |
+          cmake -B build-compat -S neozip -DZLIB_COMPAT=ON -DWITH_NEW_STRATEGIES=OFF -DWITH_OPTIM=OFF -DWITH_REDUCED_MEM=ON ${{ runner.os == 'Windows' && '-A x64' || '' }}
+          cmake --build build-compat -j4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/oss:${{ matrix.os }}"