Add CodeQL security analysis

.github/workflows/audit.yml

@@ -5,17 +5,12 @@ name: Security audit
 # pinned here, which no dependency update would surface. The schedule is what
 # makes that useful, so it runs weekly as well as on dependency changes.
 on:
+  # Keep this check present on every pull request because branch protection
+  # requires it, and dependency risk can enter through source or workflow
+  # changes even when Cargo.toml/Cargo.lock are untouched.
   pull_request:
-    paths:
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/workflows/audit.yml"
   push:
     branches: [main]
-    paths:
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - ".github/workflows/audit.yml"
   schedule:
     - cron: "0 7 * * 1"
   workflow_dispatch:

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        with:
+          languages: rust
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4

.github/workflows/release.yml

@@ -17,6 +17,7 @@ jobs:
     # is the branch name, and `gh release create` would tag the branch.
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: windows-latest
+    environment: release
     timeout-minutes: 30
     permissions:
       contents: write