From b575cac342811fcca8b50f5594d46b6d243883b7 Mon Sep 17 00:00:00 2001
From: melvinfoo6776 <67073360+melvinfoo6776@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:31:16 +0800
Subject: [PATCH] ci: enable CodeQL scanning

---
 .github/workflows/codeql.yml | 60 ++++++++++++++++++++++++++++++++++++
 CHANGELOG.md                 |  8 +++++
 README.md                    |  3 ++
 3 files changed, 71 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..64ed060
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,60 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 6 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze-python:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:python
+
+  analyze-swift:
+    name: Analyze Swift
+    runs-on: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: swift
+          build-mode: manual
+
+      - name: Build Swift target
+        run: >-
+          xcodebuild
+          -project CodexBuddyMac/CodexBuddyMac.xcodeproj
+          -scheme CodexBuddyMac
+          -configuration Debug
+          -sdk macosx
+          ARCHS="$(uname -m)"
+          CODE_SIGNING_ALLOWED=NO
+          build
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:swift
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8597e6a..26cece9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@ All notable changes to CodexBuddyMac are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## Unreleased
+
+### Added
+
+- **Continuous GitHub security scanning.** CodeQL now analyzes the Python
+  bridge and Swift app on pull requests, pushes to `main`, and a weekly
+  schedule. Dependabot alerts and security updates are enabled.
+
 ## [1.1.2] — 2026-07-14
 
 ### Fixed
diff --git a/README.md b/README.md
index 1838ee0..982da83 100644
--- a/README.md
+++ b/README.md
@@ -96,6 +96,9 @@ Open Settings from the menu to:
   require a private loopback token written to a `0600` file, and login refresh is
   rate-limited, so a stray local process or browser cannot trigger a token
   refresh. Usage responses are cached locally and are not uploaded by CodexBuddyMac.
+- GitHub Secret Scanning with push protection, Dependabot alerts and security
+  updates, and CodeQL run continuously to catch exposed credentials,
+  vulnerable dependencies, and code-security issues.
 - Do not commit local logs, build products, user data, credentials, or signing
   profiles. The included `.gitignore` excludes these files (including the runtime
   token, lock, PID, and retry-state files).