From 90cb53ccd1a12ce895269e32a188302df4338ae9 Mon Sep 17 00:00:00 2001
From: Pablo Alguindigue <palguindigue@paypal.com>
Date: Mon, 3 Mar 2025 14:04:37 -0600
Subject: [PATCH] Adding security workflows

---
 .github/workflows/codeql.yml            | 26 +++++++++++++++++++++++++
 .github/workflows/dependency-review.yml | 10 ++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 .github/workflows/dependency-review.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000..763c62d7e
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,26 @@
+name: CodeQL (Java) - SAST
+
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Code Scanning - CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+    steps:
+      - uses: hyperwallet/public-security-workflows/codeql@main
+        with:
+          language: java
+          build-mode: 'none'
+          timeout-minutes: 25
+
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 000000000..19140c5a0
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,10 @@
+name: CodeQL Dependency Review - SCA
+
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+
+jobs:
+  dependency-review:
+    uses: hyperwallet/public-security-workflows/.github/workflows/dependency-review.yml@main
\ No newline at end of file