feat: complete workflow optimization and security hardening #8

	name: CodeQL

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]
	schedule:
	- cron: '0 2 * * TUE' # Weekly on Tuesday at 2 AM UTC

	jobs:
	analyze:
	name: Analyze
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write

	strategy:
	fail-fast: false
	matrix:
	language: [ 'rust' ]

	# Prevent duplicate runs
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Initialize CodeQL
	uses: github/codeql-action/init@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f2 # v3.27.4
	with:
	languages: ${{ matrix.language }}
	# Disable pr-diff-range extension pack that causes undefined values
	queries: +security-and-quality
	# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

	- name: Install Rust
	uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a # stable
	with:
	toolchain: stable

	- name: Cache Rust dependencies
	uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab # v2.7.5
	with:
	cache-on-failure: true

	# Manual build to avoid CodeQL extension pack issues
	- name: Build
	run: cargo build --all-features

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f2 # v3.27.4
	with:
	category: "/language:${{matrix.language}}"
	# Disable automatic PR filtering to avoid extension pack issues
	upload-database: true

Provide feedback