ci(security): introduce GitHub CodeQL analysis for Rust codebase

[harmeetsingh11]

Summary

Add a dedicated GitHub CodeQL workflow to perform automated static application security testing (SAST) on the Rust codebase during pull requests and scheduled scans.

Motivation

The repository currently maintains CI validation, release automation, and contributor workflows, but does not appear to include automated security-focused code analysis.

GitHub CodeQL provides semantic analysis of Rust source code and can help identify:

• Memory safety issues
• Unsafe code misuse
• Injection vectors
• Data-flow vulnerabilities
• Privilege escalation patterns
• Dependency-related security concerns
• Logic flaws detectable through static analysis

Introducing CodeQL would strengthen the project's security posture and enable maintainers to catch issues earlier in the development lifecycle.

Proposed Changes

Create a new workflow:

.github/workflows/codeql.yml

The workflow should:

• Trigger on:

  • push to default and protected branches
  • pull_request
  • scheduled weekly scan (cron)
  • optional manual execution via workflow_dispatch

• Configure CodeQL for:

  • Rust language analysis
  • autobuild where applicable
  • dependency-aware scanning

• Upload SARIF results to GitHub Security tab

• Leverage GitHub's security dashboard integration for centralized findings management

Example Scope

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    - cron: '30 3 * * 1'
  workflow_dispatch:

Expected Benefits

• Continuous security analysis in CI
• Early detection of security regressions
• Improved review confidence for incoming contributions
• Better visibility into code health through GitHub Security alerts
• Alignment with modern open-source security best practices

Acceptance Criteria

• CodeQL workflow added under .github/workflows
• Rust language configured correctly
• Analysis runs successfully on pull requests
• SARIF reports uploaded to GitHub Security tab
• Scheduled scans execute without impacting existing CI workflows
• Documentation/comments added where necessary

Additional Notes

Care should be taken to ensure CodeQL execution remains independent from existing CI jobs (ci.yml) to avoid increasing feedback time for standard test pipelines. Security analysis should operate as a dedicated workflow with clear failure reporting and minimal coupling to release automation.

Priority

High

Record

• I have read the Contributing Guidelines
• I'm a GSSoC'26 contributor
• I want to work on this issue

[soumyasahani]

hello @harmeetsingh11 I want to work on this issue under GSSoC.Please Assign it to me.

[aishwaryagangaraj-web]

Hi @maintainers,

I'm also interested in contributing to this issue. I noticed another contributor has already requested assignment, so I'll defer to them. If the issue becomes available later, I'd be happy to work on it.

Thank you!

[MamidiDhana]

Hi @maintainers,
I’m interested in contributing to this issue under GSSoC'26 if it becomes available.
I can add a dedicated GitHub CodeQL workflow for the Rust codebase with support for push, pull_request, schedule, and workflow_dispatch, configure Rust analysis with SARIF upload, and ensure it runs independently of the existing CI pipeline.
Thank you for your consideration!

[radhikatbbt]

\claim

[Tenisha5132]

/claim
/assign
i would like to work on this issue

[aaniya22]

/assign

[github-actions]

Assigned to @aaniya22.