Initial implementation of codeql workflow

.github/codeql/codeql-config.yml

@@ -0,0 +1,9 @@
+# CodeQL configuration
+# Exclude third-party and build outputs to reduce noise and improve performance
+excludes:
+  - thirdparty/**
+  - build/**
+  - Installer/**
+
+queries:
+  - security-and-quality

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,60 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ main, dev ]
+  pull_request:
+    # Run on PRs targeting protected branches
+    branches: [ main, dev ]
+  schedule:
+    - cron: '0 2 * * 0' # Weekly
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze (CodeQL)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      security-events: write
+      contents: read
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
+
+    - name: Install Dependencies
+      run: |
+        sudo apt update
+        sudo apt install -y \
+          cmake build-essential \
+          libwayland-bin \
+          libwayland-dev libxkbcommon-dev wayland-protocols \
+          pkg-config \
+          libdbus-1-dev
+
+    - name: Install Vulkan SDK
+      run: |
+        wget -qO- https://packages.lunarg.com/lunarg-signing-key-pub.asc | sudo tee /etc/apt/trusted.gpg.d/lunarg.asc
+        sudo wget -qO /etc/apt/sources.list.d/lunarg-vulkan-jammy.list http://packages.lunarg.com/vulkan/lunarg-vulkan-jammy.list
+        sudo apt update
+        sudo apt install -y vulkan-sdk xorg-dev libx11-dev libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: cpp
+        config-file: .github/codeql/codeql-config.yml
+
+    - name: Build with CMake
+      run: |
+        mkdir -p build/codeql
+        cmake -B build/codeql --preset "linux-release"
+        cmake --build build/codeql --preset "Linux Release Build" --parallel $(nproc)
+
+    - name: Run CodeQL analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "security-and-quality"