Add CodeQL, Codecov, Codacy and actionlint

- CodeQL analyses the workflows and the TypeScript and Vue sources with
  the security-extended queries, on every push to main, every pull
  request and once a week.
- The tests run under c8, and a job of its own uploads the lcov report
  to Codecov through OIDC, away from the job that installs packages.
- .codacy.yml leaves out what is generated and what is copied from
  Progmasoft/tazel and Progmasoft/tala.
- actionlint joins zizmor in Workflow Security.
- CI Required gathers the site job and Dependency Review, so a ruleset
  can require one check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 100 insertions, 1 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2bceab7..05ee91b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,13 @@ jobs:
       - run: npm ci
       - run: npm run format:check
       - run: npm run check
-      - run: npm test
+      - run: npm run test:coverage
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tazel-net-coverage
+          path: coverage/lcov.info
+          if-no-files-found: error
+          retention-days: 1
       # Every page in every language is generated; a link to a page that does not exist fails it.
       - run: npm run generate
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -51,3 +57,39 @@ jobs:
       - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         with:
           fail-on-severity: moderate
+
+  coverage:
+    # Fork PRs cannot receive the OIDC token required for Codecov uploads.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    needs: site
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # Keep the OIDC-capable job apart from the package install and build.
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: tazel-net-coverage
+          path: coverage
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: coverage/lcov.info
+          fail_ci_if_error: true
+
+  required:
+    name: CI Required
+    if: always()
+    needs: [site, dependency-review]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # Dependency Review runs only on pull requests; skipped counts as passed.
+      - env:
+          SITE: ${{ needs.site.result }}
+          REVIEW: ${{ needs.dependency-review.result }}
+        run: |
+          test "$SITE" = success
+          test "$REVIEW" = success || test "$REVIEW" = skipped
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..597e05e
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "17 5 * * 1"
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+jobs:
+  analyze:
+    name: ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+          queries: security-extended
+      - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          category: /language:${{ matrix.language }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index ee34012..cb4653c 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -36,3 +36,24 @@ jobs:
 
       - name: Audit the workflows
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.26.10
+          cache: false
+      # actionlint checks the syntax, the expressions and the shell steps of
+      # every workflow; zizmor above checks what makes one unsafe.
+      - name: Lint the workflows
+        run: |
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+          "$(go env GOPATH)/bin/actionlint" -color