docs: add instructions for CodeQL Advanced Security configuration

rkt0209 · tillkamppeter · commit f3fc2ab3487c · 2026-03-06T16:06:13.000+01:00
diff --git a/README.md b/README.md
@@ -1215,3 +1215,22 @@ foomatic-filters package. It was not overtaken into cups-filters
 together with foomatic-rip to avoid the introduction of a dependency
 on Perl. Now it has been re-written in C and so it can be part of
 cups-filters without introducing new dependencies.
+
+---
+
+## DEVELOPMENT AND CI/CD
+
+### CodeQL Static Analysis Configuration
+
+This repository uses a custom GitHub Actions workflow for CodeQL static analysis located at `.github/workflows/static-analysis.yml`. To ensure accurate analysis and avoid conflicts with GitHub's default settings, the following repository configurations are required:
+
+1. **Enable Advanced Setup**:
+   - Go to **Settings** -> **Code security and analysis**.
+   - Under **Code scanning**, locate **CodeQL analysis**.
+   - If "Default" is enabled, click the three dots (...) and select **Switch to advanced**.
+2. **Disable Default Setup**: 
+   - The "Default" setup must be disabled for the custom workflow to upload results successfully.
+3. **Custom Workflow Dependencies**:
+   - Our custom workflow is designed to install specific project dependencies and perform a manual build before the analysis. This ensures that CodeQL has a complete build graph for the C sources in this repository.
+
+*Note: If the Default setup is active, GitHub may reject the results uploaded by the manual workflow, causing the CI job to fail.*
