1 files changed, 54 insertions, 0 deletions
diff --git a/neozip/.github/workflows/codeql.yml b/neozip/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..972c694487
--- /dev/null
+++ b/neozip/.github/workflows/codeql.yml
@@ -0,0 +1,54 @@
+name: CodeQL
+on:
+  workflow_call:
+  workflow_dispatch:
+  schedule:
+    - cron: "27 17 * * 0"
+
+jobs:
+  analyze:
+    name: CodeQL (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # https://codeql.github.com/docs/codeql-overview/system-requirements/
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - macos-26-intel
+          - windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          show-progress: 'false'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: cpp
+          queries: +security-and-quality
+
+      - name: Build default config
+        shell: bash
+        run: |
+          cmake -B build-default -S . ${{ runner.os == 'Windows' && '-A x64' || '' }}
+          cmake --build build-default -j4
+
+      - name: Build compat config without optim/strategies, with reduced mem
+        shell: bash
+        run: |
+          cmake -B build-compat -S . -DZLIB_COMPAT=ON -DWITH_NEW_STRATEGIES=OFF -DWITH_OPTIM=OFF -DWITH_REDUCED_MEM=ON ${{ runner.os == 'Windows' && '-A x64' || '' }}
+          cmake --build build-compat -j4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/oss:${{ matrix.os }}"