feat(ci): add GitHub CodeQL workflow for automated C and Go security analysis

[harmeetsingh11]

Related issue

Closes #219

Summary

This pull request introduces a dedicated GitHub Actions workflow to integrate CodeQL-based static analysis into the repository's CI pipeline for both C and Go codebases.

The workflow enables automated security scanning across pull requests, direct pushes, scheduled executions, and manual runs, allowing potential vulnerabilities and unsafe coding patterns to be identified before they reach the default branch.

What changed

• Added a new workflow at:
  • .github/workflows/codeql.yml
• Configured CodeQL analysis for:
  • c-cpp
  • go
• Added the following workflow triggers:
  • push
  • pull_request
  • workflow_dispatch
  • weekly scheduled scan (cron)
• Initialized CodeQL using the official GitHub Action.
• Included the analysis step to generate and upload SARIF results to GitHub Security.
• Structured the workflow to remain compatible with the existing CI pipeline while avoiding unnecessary duplication wherever possible.

Why this change

The repository already performs build and automation tasks, but security-focused static analysis was not part of the development workflow.

Introducing CodeQL helps shift vulnerability detection earlier into the review process by automatically inspecting every change for language-specific security issues and common implementation mistakes.

For C projects, this provides additional coverage for memory-safety and resource-management issues, while Go analysis helps identify insecure coding patterns and reliability concerns.

Expected impact

After this change:

• Pull requests are automatically scanned for potential security issues.
• Regular scheduled scans continue monitoring the default branch as the project evolves.
• Security findings become available through GitHub's Security interface.
• Contributors receive actionable feedback during code review instead of after release.

Validation

The workflow has been verified to:

• load successfully within GitHub Actions
• initialize CodeQL for both configured languages
• execute the analysis phase without workflow syntax issues
• publish analysis results in the expected SARIF format

Notes

This change is intentionally isolated to the CI configuration and does not modify application source code or runtime behavior.

Manual Verification

• Verified workflow YAML syntax and configuration
• Confirmed CodeQL matrix configuration for C and Golang
• Verified workflow triggers for push, pull_request, and scheduled execution
• Confirmed SARIF upload step is configured for GitHub Code Scanning

Checklist

• My code follows the style guidelines of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings or console errors.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[harmeetsingh11]

Hi @btwshivam,

While validating the CodeQL workflow, I noticed that the go analysis completes successfully, but the c-cpp job fails during database finalization with:

CodeQL could not process any code written in C/C++ (exit code 32)

After reviewing the repository structure, I couldn't identify a standalone C/C++ build entry point (e.g. CMakeLists.txt or a top-level Makefile) that CodeQL's autobuild can instrument. My understanding is that the C sources are related to the eBPF component and are not compiled through an independent C build during the workflow, so no compilation units are captured for CodeQL analysis.

Before changing the workflow, I'd like to confirm the intended approach. Is there an existing build command or script used to compile the eBPF C sources that should be executed as a manual CodeQL build step?

If the project currently doesn't expose a reproducible C compilation path in CI, I can:

• scope the workflow to Go until a dedicated C build stage is available.

I'd prefer to align the workflow with the project's actual build process rather than introducing build steps that don't reflect the repository's CI.