diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..a0be528
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,41 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '0 0 * * 0'
+
+jobs:
+    analyze:
+        name: Analyze
+        runs-on: ubuntu-latest
+        permissions:
+            security-events: write
+            actions: read
+            contents: read
+
+        strategy:
+            fail-fast: false
+            matrix:
+                # focus on Rust code only
+                language: [ 'rust']
+
+        steps:
+        - name: Checkout repository
+          uses: actions/checkout@v4
+          with:
+            persist-credentials: false
+        
+        - name: Initialize CodeQL
+          uses: github/codeql-action/init@v4
+          with:
+            languages: ${{ matrix.language }}
+        
+        - name: Perform CodeQL Analysis
+          uses: github/codeql-action/analyze@v4
+          with:
+            category: "/language:${{ matrix.language }}"
+
diff --git a/crates/tinyxml2/src/entity.rs b/crates/tinyxml2/src/entity.rs
index 3ab6309..e0aeb85 100644
--- a/crates/tinyxml2/src/entity.rs
+++ b/crates/tinyxml2/src/entity.rs
@@ -123,7 +123,7 @@ pub fn decode_numeric_only(input: &str) -> String {
 
 /// Attempts to decode a single numeric entity reference starting at the given byte slice.
 fn try_decode_numeric_entity(bytes: &[u8]) -> Option<(char, usize)> {
-    debug_assert!(bytes[0] == b'&');
+    debug_assert_eq!(bytes[0], b'&');
 
     // Find the semicolon
     let semi_pos = bytes.iter().position(|&b| b == b';')?;
@@ -165,7 +165,7 @@ fn try_decode_numeric_entity(bytes: &[u8]) -> Option<(char, usize)> {
 /// Returns `Some((char, bytes_consumed))` if a valid entity was decoded,
 /// or `None` if the input does not start with a valid entity reference.
 fn try_decode_entity(bytes: &[u8]) -> Option<(char, usize)> {
-    debug_assert!(bytes[0] == b'&');
+    debug_assert_eq!(bytes[0], b'&');
 
     // Find the semicolon
     let semi_pos = bytes.iter().position(|&b| b == b';')?;
diff --git a/tests/compat/harness.rs b/tests/compat/harness.rs
index ec26230..beede67 100644
--- a/tests/compat/harness.rs
+++ b/tests/compat/harness.rs
@@ -191,10 +191,9 @@ fn find_workspace_root() -> Option<PathBuf> {
         if dir.join("tests").join("corpus").exists() {
             return Some(dir);
         }
-        if let Some(parent) = dir.parent() {
+        {
+            let parent = dir.parent()?;
             dir = parent.to_path_buf();
-        } else {
-            return None;
         }
     }
 }