feat(security): add CodeQL composites and integrate into pr-security-scan

.github/workflows/self-codeql.yml

@@ -0,0 +1,57 @@
+name: Self — CodeQL
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+    paths:
+      - '**.yml'
+      - '**.yaml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  # ----------------- Changed Files Detection -----------------
+  changed-files:
+    name: Detect Changed Files
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      action_files: ${{ steps.detect.outputs.action-files }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Detect changed files
+        id: detect
+        uses: ./src/config/changed-workflows
+        with:
+          github-token: ${{ github.token }}
+
+  # ----------------- CodeQL Analysis -----------------
+  analyze:
+    name: CodeQL Analysis
+    needs: changed-files
+    if: needs.changed-files.outputs.action_files != ''
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: ./src/security/codeql-init
+        with:
+          languages: actions
+
+      - name: Perform CodeQL Analysis
+        uses: ./src/security/codeql-analyze
+        with:
+          category: '/language:actions'

src/security/codeql-analyze/README.md

@@ -0,0 +1,42 @@
+<table border="0" cellspacing="0" cellpadding="0">
+  <tr>
+    <td><img src="https://github.com/LerianStudio.png" width="72" alt="Lerian" /></td>
+    <td><h1>codeql-analyze</h1></td>
+  </tr>
+</table>
+
+Composite action that performs CodeQL analysis and uploads SARIF results to the GitHub Security tab. Designed to be paired with [`codeql-init`](../codeql-init/).
+
+## Inputs
+
+| Input | Description | Required | Default |
+|---|---|:---:|---|
+| `category` | Category for SARIF results used for deduplication (e.g., `/language:actions`) | Yes | — |
+| `output` | Output directory for SARIF files | No | `../results` |
+
+## Usage
+
+### Basic (paired with codeql-init)
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+
+  - name: Initialize CodeQL
+    uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-init@v1.x.x
+    with:
+      languages: actions
+
+  - name: Perform CodeQL Analysis
+    uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-analyze@v1.x.x
+    with:
+      category: '/language:actions'
+```
+
+## Permissions required
+
+```yaml
+permissions:
+  contents: read
+  security-events: write  # required for SARIF upload to GitHub Security tab
+```

src/security/codeql-analyze/action.yml

@@ -0,0 +1,20 @@
+name: CodeQL Analyze
+description: Perform CodeQL analysis and upload SARIF results to GitHub Security tab
+
+inputs:
+  category:
+    description: 'Category for SARIF results used for deduplication (e.g., /language:actions)'
+    required: true
+  output:
+    description: 'Output directory for SARIF files'
+    required: false
+    default: '../results'
+
+runs:
+  using: composite
+  steps:
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: ${{ inputs.category }}
+        output: ${{ inputs.output }}

src/security/codeql-init/README.md

@@ -0,0 +1,61 @@
+<table border="0" cellspacing="0" cellpadding="0">
+  <tr>
+    <td><img src="https://github.com/LerianStudio.png" width="72" alt="Lerian" /></td>
+    <td><h1>codeql-init</h1></td>
+  </tr>
+</table>
+
+Composite action that initializes CodeQL analysis for specified languages. Uses the `security-extended` query suite by default for broader coverage. Designed to be paired with [`codeql-analyze`](../codeql-analyze/).
+
+## Inputs
+
+| Input | Description | Required | Default |
+|---|---|:---:|---|
+| `languages` | Languages to analyze (comma-separated, e.g., `actions`, `javascript-typescript`, `go`) | Yes | — |
+| `queries` | Query suite to use (`security-standard`, `security-extended`, `security-and-quality`) | No | `security-extended` |
+| `config-file` | Path to CodeQL configuration file | No | — |
+
+## Usage
+
+### Basic (GitHub Actions YAML analysis)
+
+```yaml
+jobs:
+  codeql:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-init@v1.x.x
+        with:
+          languages: actions
+
+      - name: Analyze
+        uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-analyze@v1.x.x
+        with:
+          category: '/language:actions'
+```
+
+### Multiple languages
+
+```yaml
+- name: Initialize CodeQL
+  uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-init@v1.x.x
+  with:
+    languages: javascript-typescript
+    queries: security-and-quality
+```
+
+## Permissions required
+
+```yaml
+permissions:
+  contents: read
+  security-events: write
+  actions: read  # required for workflows using private repositories
+```

src/security/codeql-init/action.yml

@@ -0,0 +1,25 @@
+name: CodeQL Init
+description: Initialize CodeQL analysis for specified languages with configurable query suite
+
+inputs:
+  languages:
+    description: 'Languages to analyze (comma-separated, e.g., actions, javascript-typescript, go)'
+    required: true
+  queries:
+    description: 'Query suite to use (security-standard, security-extended, security-and-quality)'
+    required: false
+    default: 'security-extended'
+  config-file:
+    description: 'Path to CodeQL configuration file'
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ inputs.languages }}
+        queries: ${{ inputs.queries }}
+        config-file: ${{ inputs.config-file || '' }}