ci(codeql): Add CodeQL Analysis

Author: lucasssvaz

.github/workflows/push.yml

@@ -15,6 +15,11 @@ on:
           - "info"
           - "debug"
           - "verbose"
+      run_codeql:
+        description: "Enable CodeQL Analysis"
+        default: false
+        type: "boolean"
+        required: true
   schedule:
     # Every Sunday at 2:00 UTC run a build with verbose log level
     - cron: "0 2 * * SUN"
@@ -25,33 +30,39 @@ on:
   pull_request:
     paths:
       - "cores/**"
-      - "libraries/**"
-      - "!libraries/**.md"
-      - "!libraries/**.txt"
-      - "!libraries/**.properties"
-      - "!libraries/**.py"
+      - "libraries/**/*.cpp"
+      - "libraries/**/*.c"
+      - "libraries/**/*.h"
+      - "libraries/**/*.hpp"
+      - "libraries/**/*.ino"
+      - "libraries/**/ci.json"
       - "package/**"
       - "idf_component_examples/**"
-      - "tools/**.py"
+      - "tools/get.*"
       - "platform.txt"
       - "programmers.txt"
       - "idf_component.yml"
       - "Kconfig.projbuild"
       - "package.json"
       - "CMakeLists.txt"
       - ".github/workflows/push.yml"
-      - ".github/scripts/**"
-      - "!.github/scripts/find_*"
-      - "!.github/scripts/on-release.sh"
-      - "!.github/scripts/tests_*"
-      - "!.github/scripts/upload_*"
-      - "variants/esp32/**/*"
-      - "variants/esp32c3/**/*"
-      - "variants/esp32c6/**/*"
-      - "variants/esp32h2/**/*"
-      - "variants/esp32p4/**/*"
-      - "variants/esp32s2/**/*"
-      - "variants/esp32s3/**/*"
+      - ".github/scripts/check-cmakelists.sh"
+      - ".github/scripts/install-*"
+      - ".github/scripts/on-push-idf.sh"
+      - ".github/scripts/on-push.sh"
+      - ".github/scripts/set_push_chunks.sh"
+      - ".github/scripts/sketch_utils.sh"
+      - "variants/esp32/**"
+      - "variants/esp32c2/**"
+      - "variants/esp32c3/**"
+      - "variants/esp32c6/**"
+      - "variants/esp32h2/**"
+      - "variants/esp32p4/**"
+      - "variants/esp32s2/**"
+      - "variants/esp32s3/**"
+      - "!*.md"
+      - "!*.txt"
+      - "!*.properties"
 
 concurrency:
   group: build-${{github.event.pull_request.number || github.ref}}
@@ -93,18 +104,14 @@ jobs:
           files_yaml: |
             core:
               - '.github/**'
+              - '!.github/scripts/on-push-idf.sh'
               - 'cores/**'
               - 'package/**'
               - 'tools/**'
               - 'platform.txt'
               - 'programmers.txt'
-              - "variants/esp32/**/*"
-              - "variants/esp32c3/**/*"
-              - "variants/esp32c6/**/*"
-              - "variants/esp32h2/**/*"
-              - "variants/esp32p4/**/*"
-              - "variants/esp32s2/**/*"
-              - "variants/esp32s3/**/*"
+              - "variants/**"
+              - "!variants/esp32c2/**"
             libraries:
               - 'libraries/**/examples/**'
               - 'libraries/**/src/**'
@@ -121,10 +128,12 @@ jobs:
               - 'libraries/BLE/src/**'
               - 'libraries/Insights/src/**'
             idf:
+              - '.github/scripts/on-push-idf.sh'
               - 'idf_component.yml'
               - 'Kconfig.projbuild'
               - 'CMakeLists.txt'
               - "idf_component_examples/**"
+              - "variants/esp32c2/**"
 
       - name: Set chunks
         id: set-chunks
@@ -168,6 +177,13 @@ jobs:
         with:
           python-version: "3.x"
 
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        if: ${{ github.event_name == 'schedule' || inputs.run_codeql == 'true' }}
+        with:
+          languages: cpp
+          build-mode: manual
+
       - name: Get libs cache
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
@@ -213,6 +229,12 @@ jobs:
           path: cli_compile_${{ matrix.chunk }}.json
           overwrite: true
 
+      - name: Run CodeQL Analysis
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        if: ${{ github.event_name == 'schedule' || inputs.run_codeql == 'true' }}
+        with:
+          check_name: "CodeQL Chunk ${{ matrix.chunk }}"
+
   # Windows and MacOS
   build-arduino-win-mac:
     name: Arduino on ${{ matrix.os }}