copy workflows from blueapi, [still need to configure env values -not a code change]

.github/workflows/_codeql.yml

@@ -0,0 +1,35 @@
+name: "CodeQL"
+
+on:
+  workflow_call:
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    runs-on: "ubuntu-latest"
+    timeout-minutes: 120
+    permissions:
+      # required for all workflows
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+          build-mode: none
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:python"
+      - name: Debug SARIF File
+        run: cat results/python.sarif
+      - name: Upload CodeQL Analysis Results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: results/python.sarif

.github/workflows/periodic.yml

@@ -11,3 +11,5 @@ jobs:
     uses: ./.github/workflows/_tox.yml
     with:
       tox: docs build -- -b linkcheck
+  codeql:
+    uses: ./.github/workflows/_codeql.yml