github: Add CodeQL workflow

scripts/test.sh

@@ -219,7 +219,7 @@ wolfssl)
 printf-builtin)
 	CONFIG="--with-printf-hooks=builtin"
 	;;
-all|coverage|sonarcloud)
+all|codeql|coverage|sonarcloud)
 	if [ "$TEST" = "sonarcloud" ]; then
 		if [ -z "$SONAR_PROJECT" -o -z "$SONAR_ORGANIZATION" -o -z "$SONAR_TOKEN" ]; then
 			echo "The SONAR_PROJECT, SONAR_ORGANIZATION and SONAR_TOKEN" \
@@ -227,6 +227,10 @@ all|coverage|sonarcloud)
 			exit 1
 		fi
 	fi
+	if [ "$TEST" = "codeql" ]; then
+		# don't run tests, only analyze built code
+		TARGET=
+	fi
 	CONFIG="--enable-all --disable-android-dns --disable-android-log
 			--disable-kernel-pfroute --disable-keychain
 			--disable-lock-profiler --disable-padlock --disable-fuzzing
@@ -498,7 +502,7 @@ CONFIG="$CONFIG
 	--enable-leak-detective=${LEAK_DETECTIVE-no}"
 
 case "$TEST" in
-	coverage|freebsd|fuzzing|sonarcloud|win*)
+	codeql|coverage|freebsd|fuzzing|sonarcloud|win*)
 		# don't use AddressSanitizer if it's not available or causes conflicts
 		CONFIG="$CONFIG --disable-asan"
 		;;