[abhinavagarwal07]

Add codeql.yml running the CodeQL security-extended suite on the C code, in manual build mode (meson debug build of sshfs). It catches things like format strings (CWE-134) and buffer overflows (CWE-120).

Runs on push and PR to master, weekly on Mondays, and on manual dispatch. Actions are pinned to full SHAs, checkout and setup-python the same as the other workflows. The workflow default is contents: read, and only the job gets security-events: write.

The CodeQL CLI and query packs are not pinned, they follow the action's default (latest bundle).

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

🟢 Approval recommended

The workflow matches the stated scope and manual-build requirements, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Adds CodeQL static analysis for the project’s C code using the security-extended suite and a manual Meson debug build of sshfs.

Changes:

• Runs on pushes and pull requests to master, weekly on Mondays, and manual dispatch.
• Installs build dependencies, builds sshfs, and submits CodeQL analysis results.
• Pins actions to full commit SHAs and limits security-events: write permission to the analysis job.

File	Description
.github/​workflows/​codeql.yml	Adds the CodeQL workflow, including triggers, permissions, build steps, and analysis.

_{Review effort: Balanced}