Expand continuous integration coverage

.dockerignore

@@ -0,0 +1 @@
+.git

.github/docker/wolfsentry-ci/Dockerfile

@@ -0,0 +1,14 @@
+FROM ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        bubblewrap \
+        dbus \
+        gcc-arm-none-eabi \
+        iproute2 \
+        iputils-ping \
+        libnewlib-arm-none-eabi \
+        libnotify-dev \
+        python3-dbus \
+        python3-gi \
+    && rm -rf /var/lib/apt/lists/*

.github/semgrep-rules.yml

@@ -0,0 +1,40 @@
+# Deterministic wolfSentry security rules. Style and maintainability checks
+# belong to cppcheck and clang-tidy; these rules cover unsafe primitives.
+
+rules:
+  - id: wolfsentry-unsafe-libc
+    languages: [c]
+    severity: ERROR
+    message: Use a length-bounded alternative to this unsafe C library call.
+    paths:
+      include:
+        - src/
+        - wolfsentry/
+    pattern-either:
+      - pattern: gets(...)
+      - pattern: strcpy(...)
+      - pattern: strcat(...)
+      - pattern: sprintf(...)
+      - pattern: vsprintf(...)
+
+  - id: wolfsentry-shell-execution
+    languages: [c]
+    severity: ERROR
+    message: Core library code must not invoke a command shell.
+    paths:
+      include:
+        - src/
+        - wolfsentry/
+    pattern-either:
+      - pattern: system(...)
+      - pattern: popen(...)
+
+  - id: wolfsentry-insecure-temporary-name
+    languages: [c]
+    severity: ERROR
+    message: mktemp is race-prone; use mkstemp or an equivalent safe primitive.
+    paths:
+      include:
+        - src/
+        - wolfsentry/
+    pattern: mktemp(...)

.github/workflows/codeql.yml

@@ -0,0 +1,52 @@
+name: CodeQL
+
+run-name: ${{ inputs.nightly_run_id || github.workflow }}
+
+on:
+  push:
+    branches: [ 'master', 'release/**' ]
+  pull_request:
+    branches: [ '**' ]
+  workflow_dispatch:
+    inputs:
+      nightly_run_id:
+        description: Nightly coordinator run ID
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash -e {0}
+
+jobs:
+  analyze:
+    name: CodeQL (C/C++)
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
+    timeout-minutes: 30
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Trust workspace
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: c-cpp
+        build-mode: manual
+        queries: security-extended
+    - name: Build all default unit-test paths
+      run: make -j2 UNITTEST_LIST_JSON_DOM_EXTRAS=test_json_corpus test
+    - name: Perform CodeQL analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: /language:c-cpp

.github/workflows/coverage.yml

@@ -0,0 +1,53 @@
+name: Code Coverage
+
+run-name: ${{ inputs.nightly_run_id || github.workflow }}
+
+on:
+  push:
+    branches: [ 'master', 'release/**' ]
+  pull_request:
+    branches: [ '**' ]
+  workflow_dispatch:
+    inputs:
+      nightly_run_id:
+        description: Nightly coordinator run ID
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash -e {0}
+
+jobs:
+  coverage:
+    name: Line coverage
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/wolfssl/wolfcose-ci@sha256:c073c7afb4cd3f296b8c1a305db2f718530b7a8aca899482629aee3a5cf8bfbc
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Trust workspace
+      run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+    - name: Run instrumented unit tests
+      run: make coverage
+    - name: Capture coverage
+      run: |
+        lcov --capture --directory coverage-build --output-file coverage.info
+        lcov --remove coverage.info '/usr/*' '*/tests/*' \
+          '*/src/json/centijson_sax.c' --ignore-errors unused \
+          --output-file coverage.info
+        lcov --summary coverage.info
+        lcov --fail-under-lines 65 --summary coverage.info
+    - name: Upload coverage data
+      uses: actions/upload-artifact@v4
+      with:
+        name: wolfsentry-coverage
+        path: coverage.info