Add CodeQL, Codecov, Codacy, Renovate and actionlint

- CodeQL analyses the workflows and the C++ sources, without a build,
  with the security-extended queries, on every push to main, every pull
  request and once a week.
- A coverage job runs the tests under Clang's own coverage on Linux and
  a job of its own uploads the lcov report to Codecov through OIDC.
- .codacy.yml leaves out the output of Bazel and the rules_cc patch.
- Renovate proposes Bazel modules, Bazel itself and GitHub Actions once
  a week, a week after their release; rules_cc waits for approval on
  the dashboard, since its clang-cl patch has to be checked first.
- actionlint joins zizmor in Workflow Security.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 101 insertions, 0 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7d357e0..f708012 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,50 @@ jobs:
       - run: bazelisk test //...
       - run: bazelisk build //:tazelish
 
+  coverage-report:
+    name: Coverage report
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Clang's own coverage, read by the LLVM tools of the runner's Clang.
+      - run: >-
+          bazelisk coverage //Tests:tests
+          --combined_report=lcov
+          --instrumentation_filter=^//:
+          --repo_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
+          --repo_env=GCOV=/usr/bin/llvm-profdata-18
+          --repo_env=BAZEL_LLVM_COV=/usr/bin/llvm-cov-18
+      - run: cp "$(bazelisk info output_path)/_coverage/_coverage_report.dat" lcov.info
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tazelish-coverage
+          path: lcov.info
+          if-no-files-found: error
+          retention-days: 1
+
+  coverage:
+    # Fork PRs cannot receive the OIDC token required for Codecov uploads.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    needs: coverage-report
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # Keep the OIDC-capable job apart from the build.
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: tazelish-coverage
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: lcov.info
+          fail_ci_if_error: true
+
   required:
     name: CI Required
     if: always()
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..388864c
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
+
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "29 5 * * 1"
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+jobs:
+  analyze:
+    name: ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, c-cpp]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: ./.github/codeql/codeql-config.yml
+          queries: security-extended
+      - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
+        with:
+          category: /language:${{ matrix.language }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index b81dac0..7b9a0e7 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -36,3 +36,24 @@ jobs:
 
       - name: Audit the workflows
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: 1.26.10
+          cache: false
+      # actionlint checks the syntax, the expressions and the shell steps of
+      # every workflow; zizmor above checks what makes one unsafe.
+      - name: Lint the workflows
+        run: |
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+          "$(go env GOPATH)/bin/actionlint" -color