From 0070ada22b50326ad73cbcc17c9086564bbe2456 Mon Sep 17 00:00:00 2001
From: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
Date: Fri, 6 Nov 2026 09:25:20 +0100
Subject: [PATCH 1/4] Configure Copilot to use org runners

Signed-off-by: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
---
 .github/workflows/copilot-code-review.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 .github/workflows/copilot-code-review.yml

diff --git a/.github/workflows/copilot-code-review.yml b/.github/workflows/copilot-code-review.yml
new file mode 100644
index 0000000..208fd77
--- /dev/null
+++ b/.github/workflows/copilot-code-review.yml
@@ -0,0 +1,14 @@
+name: Copilot Code Review
+
+on: workflow_dispatch
+
+jobs:
+    copilot-setup-steps:
+        runs-on: intel-ubuntu-latest
+        permissions:
+            contents: read
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  persist-credentials: false

From ef5262a40abfdbef2ad57999d0f0deb8bd42dc1a Mon Sep 17 00:00:00 2001
From: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
Date: Fri, 6 Nov 2026 08:53:44 +0100
Subject: [PATCH 2/4] Configure CodeQL manually

Signed-off-by: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
---
 .github/workflows/codeql.yml | 39 ++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..2c46acc
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,39 @@
+name: CodeQL
+
+on:
+    push:
+        branches: ["main"]
+    pull_request:
+    workflow_dispatch:
+    schedule:
+        - cron: "20 4 * * 0"
+
+permissions:
+    contents: read
+
+jobs:
+    analyze:
+        name: Analyze JavaScript/TypeScript
+        runs-on: intel-ubuntu-latest
+        timeout-minutes: 45
+        permissions:
+            actions: read
+            contents: read
+            security-events: write
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  persist-credentials: false
+
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+              with:
+                  languages: javascript-typescript
+                  build-mode: none
+
+            - name: Perform CodeQL analysis
+              uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+              with:
+                  category: "/language:javascript-typescript"

From 5d88a0120a02226c21aa2e7054daafb52a14510b Mon Sep 17 00:00:00 2001
From: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
Date: Fri, 6 Nov 2026 09:31:56 +0100
Subject: [PATCH 3/4] Also run analysis on GitHub actions workflows

Signed-off-by: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
---
 .github/workflows/codeql.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2c46acc..8c8309f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
     analyze:
-        name: Analyze JavaScript/TypeScript
+        name: Analyze (${{ matrix.language }})
         runs-on: intel-ubuntu-latest
         timeout-minutes: 45
         permissions:
@@ -21,6 +21,11 @@ jobs:
             contents: read
             security-events: write
 
+        strategy:
+            fail-fast: false
+            matrix:
+                language: [actions, javascript-typescript]
+
         steps:
             - name: Checkout repository
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -30,10 +35,10 @@ jobs:
             - name: Initialize CodeQL
               uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
               with:
-                  languages: javascript-typescript
+                  languages: ${{ matrix.language }}
                   build-mode: none
 
             - name: Perform CodeQL analysis
               uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
               with:
-                  category: "/language:javascript-typescript"
+                  category: "/language:${{ matrix.language }}"

From e3d13abf1ee7bc997a2f23bf4ae617e2f3257fff Mon Sep 17 00:00:00 2001
From: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
Date: Fri, 6 Nov 2026 09:37:46 +0100
Subject: [PATCH 4/4] Show CodeQL status in the README

Signed-off-by: Erasmus Cedernaes <erasmus.cedernaes@intel.com>
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index eb1aa9d..53ea97c 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,7 @@
     <td align="left" border="0" valign="middle">
       <a href="https://github.com/intel/simics-vs-code-tcf-debug/actions/workflows/test.yml"><img src="https://github.com/intel/simics-vs-code-tcf-debug/actions/workflows/test.yml/badge.svg" alt="Tests" align="middle"></a>&nbsp;
       <a href="LICENSE.md"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT" align="middle"></a>&nbsp;
+      <a href="https://github.com/intel/simics-vs-code-tcf-debug/actions/workflows/codeql.yml"><img src="https://github.com/intel/simics-vs-code-tcf-debug/actions/workflows/codeql.yml/badge.svg" alt="CodeQL" align="middle"></a>&nbsp;
       <a href="https://scorecard.dev/viewer/?uri=github.com/intel/simics-vs-code-tcf-debug"><img src="https://api.securityscorecards.dev/projects/github.com/intel/simics-vs-code-tcf-debug/badge" alt="OpenSSF Scorecard" align="middle"></a>&nbsp;
       <a href="https://www.bestpractices.dev/projects/16330"><img src="https://www.bestpractices.dev/projects/16330/badge" alt="OpenSSF Best Practices" align="middle"></a>
     </td>