PYTHON-5877 Add codeql composite action

README.md

@@ -252,6 +252,60 @@ There are several ways to specify the security report:
 - By specifying a relative path, which is then linked to the corresponding git blob for the tagged version
 - By adding the `security-report-url` to the AWS Secrets Vault
 
+## Security Actions
+
+### CodeQL Analysis
+
+This action runs CodeQL analysis for a single language. It includes checkout,
+Python setup (only when `language: python`), CodeQL initialization, an optional
+manual build step, and the analysis itself — centralising the pinned CodeQL
+action version so Dependabot only needs to update one file across all repos
+using the action.
+
+```yaml
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: cpp
+            build-mode: manual
+            manual-build-command: make
+          - language: python
+            build-mode: none
+          - language: actions
+            build-mode: none
+    steps:
+      - uses: mongodb-labs/drivers-github-tools/codeql@v3
+        with:
+          language: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          manual-build-command: ${{ matrix.manual-build-command }}
+          config: |
+            paths-ignore:
+              - 'doc/**'
+              - 'test/**'
+```
+
+Pass `ref` when the workflow is invoked via `workflow_call` with a specific git
+ref:
+
+```yaml
+      - uses: mongodb-labs/drivers-github-tools/codeql@v3
+        with:
+          language: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          manual-build-command: ${{ matrix.manual-build-command }}
+          ref: ${{ inputs.ref }}
+```
+
 ## Other Common Actions
 
 ### Full Report

codeql/action.yml

@@ -0,0 +1,73 @@
+name: CodeQL Analysis
+description: Run CodeQL analysis for a single language.
+
+inputs:
+  language:
+    description: Language to analyze (e.g. cpp, python, actions, javascript).
+    required: true
+  build-mode:
+    description: Build mode for CodeQL (none, manual, autobuild).
+    default: none
+  manual-build-command:
+    description: Shell command to run when build-mode is manual.
+    default: ''
+  ref:
+    description: Git ref to check out. Leave empty to fall back to github.ref (the triggering ref).
+    default: ''
+  queries:
+    description: CodeQL query suite to run.
+    default: security-extended
+  config:
+    description: Inline CodeQL YAML configuration (e.g. a paths-ignore block).
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      env:
+        FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+        persist-credentials: false
+
+    - if: ${{ inputs.language == 'python' }}
+      uses: actions/setup-python@v5
+      env:
+        FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      env:
+        FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+      with:
+        languages: ${{ inputs.language }}
+        build-mode: ${{ inputs.build-mode }}
+        queries: ${{ inputs.queries }}
+        config: ${{ inputs.config }}
+
+    - if: ${{ inputs.build-mode == 'manual' }}
+      name: Build
+      shell: bash
+      env:
+        MANUAL_BUILD_COMMAND: ${{ inputs.manual-build-command }}
+      run: |
+        if [ -z "$MANUAL_BUILD_COMMAND" ]; then
+          echo "::error::build-mode is 'manual' but no manual-build-command was provided." >&2
+          exit 1
+        fi
+        bash -c "$MANUAL_BUILD_COMMAND"
+
+    - if: ${{ inputs.build-mode == 'autobuild' }}
+      name: Autobuild
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      env:
+        FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      env:
+        FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+      with:
+        category: "/language:${{ inputs.language }}"