4 files changed, 61 insertions, 2 deletions
diff --git a/.github/workflows/ah_token_refresh.yml b/.github/workflows/ah_token_refresh.yml
new file mode 100644
index 00000000..09d2f9db
--- /dev/null
+++ b/.github/workflows/ah_token_refresh.yml
@@ -0,0 +1,14 @@
+name: Refresh the automation hub token
+# the token expires every 30 days, so we need to refresh it
+on:
+    schedule:
+        - cron: '0 12 1,15 * *' # run 12pm on the 1st and 15th of the month
+    workflow_dispatch:
+
+jobs:
+    refresh:
+        uses: ansible/team-devtools/.github/workflows/ah_token_refresh.yml@v26.4.0
+        with:
+            environment: release
+        secrets:
+            ah_token: ${{ secrets.AH_TOKEN }}
diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
new file mode 100644
index 00000000..fa96d19d
--- /dev/null
+++ b/.github/workflows/cla-check.yml
@@ -0,0 +1,15 @@
+name: "CLA Check"
+permissions:
+  actions: write
+  contents: read
+  pull-requests: write
+  statuses: write
+on:
+  pull_request_target:
+    types: [opened, synchronize, closed]
+  issue_comment:
+    types: [created]
+jobs:
+  call-cla-assistant:
+    uses: vyos/vyos-cla-signatures/.github/workflows/cla-reusable.yml@production
+    secrets: inherit
diff --git a/.github/workflows/codecoverage.yml b/.github/workflows/codecoverage.yml
index 49c51310..5f8945d8 100644
--- a/.github/workflows/codecoverage.yml
+++ b/.github/workflows/codecoverage.yml
@@ -29,7 +29,7 @@ jobs:
           fetch-depth: "0"
 
       - name: Set up Python ${{ env.python_version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ env.python_version }}
 
@@ -62,7 +62,7 @@ jobs:
         working-directory: ${{ steps.identify.outputs.collection_path }}
 
       - name: Upload coverage report to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           directory: ${{ steps.identify.outputs.collection_path }}
           fail_ci_if_error: false
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..b83b94e0
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,30 @@
+name: "Perform CodeQL Analysis"
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**'
+      - '!.github/**'
+      - '!**/*.md'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**'
+      - '!.github/**'
+      - '!**/*.md'
+  schedule:
+    - cron: '52 13 * * 0'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  codeql-analysis-call:
+    uses: vyos/.github/.github/workflows/codeql-analysis.yml@production
+    with:
+      languages: "['python']"