diff --git a/.github/.patch_files b/.github/.patch_files
index 7a34e1cb..4ae9d9e2 100644
--- a/.github/.patch_files
+++ b/.github/.patch_files
@@ -4,19 +4,28 @@
 .github/dependabot.yml
 .github/labels.yml
 .github/workflows/approve-bot-pr.yml
+.github/workflows/codeql-analysis.yml
+.github/workflows/create-draft-release.yml
 .github/workflows/label-pr.yml
 .github/workflows/lint-yaml.yml
 .github/workflows/lint.yml
+.github/workflows/publish-releases.yml
+.github/workflows/push-buildpackage.yml
 .github/workflows/synchronize-labels.yml
 .github/workflows/test-pull-request.yml
 .github/workflows/update-buildpack-toml.yml
 .github/workflows/update-github-config.yml
+.github/workflows/update-go-mod-version.yml
 .gitignore
 LICENSE
 NOTICE
 README.md
+go.mod
+go.sum
 scripts/.util/builders.sh
 scripts/.util/print.sh
 scripts/.util/tools.json
 scripts/.util/tools.sh
 scripts/integration.sh
+scripts/package.sh
+scripts/publish.sh
\ No newline at end of file
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 00000000..8afce9c2
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,33 @@
+name: "CodeQL"
+
+on:
+  pull_request:
+    branches: [ main ]
+  schedule:
+  - cron: '34 5 * * *'  # daily at 5:34am UTC
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-24.04
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+        - 'go'
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v4
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4