[ymatrix1]

• I have read and followed the Contribution Guidelines.
• I have read and followed the AI Policy.
• I have read and followed the Coding Guidelines to the best of my ability.

---

Summary

Adds a CodeQL C/C++ scan (.github/workflows/codeql.yml).

• Uses build-mode: none with the security-extended queries, so it reads the sources without compiling the emulator.
• Ignores externals/, src/dynarmic/externals/ and src/tests/.
• Runs on PRs and pushes to nx2 that touch src/**, weekly, and on manual dispatch.

Testing

Passed on a fork test PR. Findings on the existing code have not been triaged.

Summary by CodeRabbit

• Chores
  • Added automated CodeQL analysis for C/C++ code. The workflow runs for relevant pull requests and pushes, on a weekly schedule, and when manually triggered. Analysis results are reported through the repository’s security checks.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a151bd44-d874-4c42-a18a-5067ae4383d7

Commits

Reviewing files that changed from the base of the PR and between 6015ef8 and 3524c7b.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The pull request adds a GitHub Actions workflow for C/C++ CodeQL analysis. The workflow runs on selected pull requests and pushes, on a weekly schedule, and when manually dispatched.

Changes: CodeQL analysis

Layer / File(s)	Summary
Configure and run CodeQL analysis .github/workflows/codeql.yml	The workflow sets pull request and push filters, a weekly schedule, manual dispatch, and concurrency rules. It runs CodeQL with security-extended queries, specified path exclusions, and read/write permissions for required GitHub resources.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: crueter, takoroka

Merge Risk: Minimal · previous review afbe5

This adds a CodeQL security scan for C/C++ sources without changing runtime behavior. No merge-blocking problem was found. Findings in existing code have not been triaged, and scan coverage of the Qt frontend may be incomplete.

Architecture risk: Low · up to afbe5

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/codeql.yml: Adds pull-request and nx2 push triggers filtered to src/** and this workflow, a weekly Monday 08:00 UTC schedule, and manual dispatch.
• observed — Modified behavior in .github/workflows/codeql.yml: Adds concurrency grouping by pull-request number or ref, with in-progress cancellation enabled only for pull-request events.
• observed — Modified behavior in .github/workflows/codeql.yml: Adds an Ubuntu CodeQL analysis job with a 60-minute timeout and permissions to read contents and actions and write security events. It checks out the source, initializes C/C++ analysis using build-mode: none and security-extended queries, ignores the specified external and test paths, and runs the analysis step.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "ci: add CodeQL C/C++ scan" matches the main change. The PR adds a CodeQL workflow for C/C++ analysis in .github/workflows/codeql.yml, and the PR objectives and commit message describe the s…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "ci: add CodeQL C/C++ scan" matches the main change. The PR adds a CodeQL workflow for C/C++ analysis in .github/workflows/codeql.yml, and the PR objectives and commit message describe the same change. The title is short, specific, and uses a conventional commit prefix.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: dcb4f2d0-382e-4d6b-bb22-14d7fe044e48

Commits

Reviewing files that changed from the base of the PR and between ca48a01 and afbe5c3.

Files selected for processing: 1

• .github/workflows/codeql.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.