diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml
new file mode 100644
index 0000000..50a60b2
--- /dev/null
+++ b/.github/codeql-config.yml
@@ -0,0 +1,2 @@
+paths-ignore:
+ - 'test/projects/broken/**/*'
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 0000000..b753d9a
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,19 @@
+name: CodeQL Analysis
+
+on:
+  push:
+    branches:
+      - master
+      - v*
+  pull_request:
+
+jobs:
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          config-file: ./.github/codeql-config.yml
\ No newline at end of file
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 652c42c..8a5b423 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,5 +1,10 @@
 name: Test
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - master
+      - v*
+  pull_request:
 
 permissions: read-all