Add CodeQL analysis workflow configuration

[xhuff]

Pull Request Details

Per NI Secure Development Lifecycle (SDL) guidance, enable Static Analysis Security Testing (SAST) via CodeQL

Description

Analyzing source code and configuration prior to compilation provides a highly scalable method of security code review and helps ensure that secure policies are being followed. SAST is typically integrated into the commit pipeline to identify vulnerabilities each time the software is built or packaged. However, some offerings integrate into the developer environment to spot certain flaws such as the existence of unsafe or other banned functions and replace those with safer alternatives as the developer is actively coding. Development teams may decide the optimal frequency for performing SAST scans based on the product(s) they develop and may deploy multiple tactics—to balance productivity with adequate security coverage.

Testing Done

None, this was an auto-generated change

Checklist

N/A?

[github-actions]

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[xhuff]

I have read the CLA Document and I hereby sign the CLA

[Copilot]

Pull request overview

This PR adds a GitHub Actions workflow to enable CodeQL-based SAST scanning in the repository, aligning with the NI Secure Development Lifecycle (SDL) guidance mentioned in the PR description.

Changes:

• Adds a new .github/workflows/codeql.yml workflow for CodeQL “Advanced” analysis.
• Configures the workflow to run on pushes/PRs to master and UHD-3.9.LTS, plus a weekly scheduled run.
• Sets up a language matrix for CodeQL analysis (actions, C/C++, JS/TS, Python).

Comments suppressed due to low confidence (1)

.github/workflows/codeql.yml:94

• The remaining step entries (manual-build and analyze) are also not indented under steps:. This continues the YAML structure issue and will prevent the workflow from loading.

    - name: Run manual build steps
      if: matrix.build-mode == 'manual'
      shell: bash
      run: |

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[xhuff]

Per Marian Koop, submissions aren't accepted to uhd, directly, but must go to the private uhddev repo first then get integrated over