diff --git a/docs/schemas/codeql-metrics-schema.json b/docs/schemas/codeql-metrics-schema.json
new file mode 100644
index 00000000000..1b1039ec2b3
--- /dev/null
+++ b/docs/schemas/codeql-metrics-schema.json
@@ -0,0 +1,143 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://eclipse-score.github.io/codeql-metrics-schema.json",
+  "title": "CodeQL Metrics Schema",
+  "description": "Schema for code quality metrics extracted from CodeQL SARIF results",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "generated_by",
+    "overall_metrics",
+    "metrics_by_severity",
+    "metrics_by_rule"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "type": "string",
+      "const": "1",
+      "description": "Schema version for backward compatibility"
+    },
+    "generated_by": {
+      "type": "string",
+      "description": "Tool/script that generated this metrics file (e.g., 'extract_codeql_metrics.py')"
+    },
+    "generated_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "ISO 8601 timestamp when metrics were generated"
+    },
+    "overall_metrics": {
+      "type": "object",
+      "description": "Aggregate metrics across all findings",
+      "additionalProperties": false,
+      "required": [
+        "total_findings",
+        "errors",
+        "warnings",
+        "notes"
+      ],
+      "properties": {
+        "total_findings": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Total count of all findings"
+        },
+        "errors": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Count of findings with severity 'error'"
+        },
+        "warnings": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Count of findings with severity 'warning'"
+        },
+        "notes": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Count of findings with severity 'note'"
+        }
+      }
+    },
+    "metrics_by_severity": {
+      "type": "object",
+      "description": "Detailed breakdown by severity level with percentages",
+      "additionalProperties": false,
+      "properties": {
+        "error": {
+          "$ref": "#/$defs/severityMetrics"
+        },
+        "warning": {
+          "$ref": "#/$defs/severityMetrics"
+        },
+        "note": {
+          "$ref": "#/$defs/severityMetrics"
+        }
+      }
+    },
+    "metrics_by_rule": {
+      "type": "object",
+      "description": "Findings grouped by rule ID, sorted by count (descending). Keys are rule IDs.",
+      "additionalProperties": {
+        "$ref": "#/$defs/ruleMetrics"
+      }
+    }
+  },
+  "$defs": {
+    "severityMetrics": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "count",
+        "percentage"
+      ],
+      "properties": {
+        "count": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Number of findings at this severity level"
+        },
+        "percentage": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 100,
+          "description": "Percentage of total findings"
+        }
+      }
+    },
+    "ruleMetrics": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "count",
+        "severity"
+      ],
+      "properties": {
+        "count": {
+          "type": "integer",
+          "minimum": 1,
+          "description": "Number of findings for this rule"
+        },
+        "severity": {
+          "type": "string",
+          "enum": [
+            "error",
+            "warning",
+            "note"
+          ],
+          "description": "Severity level of findings for this rule"
+        },
+        "rule_name": {
+          "type": "string",
+          "description": "Human-readable rule name/description"
+        },
+        "rule_url": {
+          "type": "string",
+          "format": "uri",
+          "description": "URL to rule documentation (if available)"
+        }
+      }
+    }
+  }
+}
diff --git a/scripts/tooling/BUILD b/scripts/tooling/BUILD
index c2088414897..7a8454ff8a4 100644
--- a/scripts/tooling/BUILD
+++ b/scripts/tooling/BUILD
@@ -81,6 +81,22 @@ py_binary(
     visibility = ["//visibility:public"],
 )
 
+py_binary(
+    name = "extract_codeql_metrics",
+    srcs = ["cli/workflow/extract_codeql_metrics.py"],
+    main = "cli/workflow/extract_codeql_metrics.py",
+    visibility = ["//visibility:public"],
+    deps = [":lib"] + all_requirements,
+)
+
+py_binary(
+    name = "generate_misra_report",
+    srcs = ["cli/workflow/generate_misra_report.py"],
+    main = "cli/workflow/generate_misra_report.py",
+    visibility = ["//visibility:public"],
+    deps = [":lib"] + all_requirements,
+)
+
 # Tests target
 score_py_pytest(
     name = "tooling_tests",
diff --git a/scripts/tooling/cli/main.py b/scripts/tooling/cli/main.py
index 36b138ad729..b3539a94e38 100644
--- a/scripts/tooling/cli/main.py
+++ b/scripts/tooling/cli/main.py
@@ -21,9 +21,11 @@ def main() -> None:
 
     from scripts.tooling.cli.misc import register as _register_misc
     from scripts.tooling.cli.release import register as _register_release
+    from scripts.tooling.cli.workflow import register as _register_workflow
 
     _register_misc(subparsers)
     _register_release(subparsers)
+    _register_workflow(subparsers)
 
     args = parser.parse_args()
     sys.exit(args.func(args))
diff --git a/scripts/tooling/cli/misc/assets/report_template.html b/scripts/tooling/cli/misc/assets/report_template.html
index f3b501af52c..ae72d3c7db7 100644
--- a/scripts/tooling/cli/misc/assets/report_template.html
+++ b/scripts/tooling/cli/misc/assets/report_template.html
@@ -247,6 +247,124 @@
     }
     .pat-notice a { color: var(--accent); }
 
+    /* ── Code Quality Section ──────────────────────────────────── */
+    #code-quality-section {
+      max-width: 1400px;
+      margin: 2.5rem auto;
+      padding: 1.5rem;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: var(--radius);
+      display: none;
+    }
+    #code-quality-section.visible { display: block; }
+
+    .cq-header {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      margin-bottom: 1.5rem;
+    }
+    .cq-header h2 {
+      font-size: 1.1rem;
+      font-weight: 600;
+      color: #e6edf3;
+      margin: 0;
+    }
+    .cq-header .cq-timestamp {
+      font-size: 0.75rem;
+      color: var(--muted);
+    }
+
+    .cq-metrics-grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+      gap: 1rem;
+      margin-bottom: 1.5rem;
+    }
+
+    .cq-metric-card {
+      background: #0d1117;
+      border: 1px solid var(--border);
+      border-radius: 6px;
+      padding: 1rem;
+      text-align: center;
+    }
+    .cq-metric-card .cq-value {
+      font-size: 2rem;
+      font-weight: 700;
+      margin-bottom: 0.3rem;
+    }
+    .cq-metric-card.error .cq-value { color: var(--red); }
+    .cq-metric-card.warning .cq-value { color: var(--yellow); }
+    .cq-metric-card.note .cq-value { color: var(--muted); }
+    .cq-metric-card .cq-label {
+      font-size: 0.82rem;
+      color: var(--muted);
+    }
+    .cq-metric-card .cq-percent {
+      font-size: 0.75rem;
+      color: var(--muted);
+      margin-top: 0.4rem;
+    }
+
+    .cq-rules-section {
+      margin-top: 1.5rem;
+    }
+    .cq-rules-header {
+      font-size: 0.95rem;
+      font-weight: 600;
+      color: #e6edf3;
+      margin-bottom: 0.8rem;
+    }
+    .cq-rules-table {
+      width: 100%;
+      border-collapse: collapse;
+      font-size: 0.82rem;
+    }
+    .cq-rules-table th {
+      background: #161b22;
+      border: 1px solid var(--border);
+      padding: 0.6rem 0.8rem;
+      text-align: left;
+      font-weight: 600;
+      color: var(--text);
+    }
+    .cq-rules-table td {
+      border: 1px solid var(--border);
+      padding: 0.6rem 0.8rem;
+      color: var(--text);
+    }
+    .cq-rules-table tr:hover { background: #161b22; }
+    .cq-rule-name { font-weight: 500; }
+    .cq-rule-count {
+      text-align: center;
+      font-weight: 600;
+    }
+    .cq-rule-severity {
+      text-align: center;
+      font-size: 0.7rem;
+      font-weight: 600;
+      text-transform: uppercase;
+      padding: 0.25rem 0.4rem !important;
+      border-radius: 3px;
+      width: fit-content;
+      margin: 0 auto;
+    }
+    .cq-rule-severity.error { background: #f8514922; color: var(--red); }
+    .cq-rule-severity.warning { background: #d2992222; color: var(--yellow); }
+    .cq-rule-severity.note { background: #3fb95022; color: var(--text); }
+
+    .cq-footer {
+      margin-top: 1rem;
+      padding-top: 1rem;
+      border-top: 1px solid var(--border);
+      font-size: 0.75rem;
+      color: var(--muted);
+    }
+    .cq-footer a { color: var(--accent); text-decoration: none; }
+    .cq-footer a:hover { text-decoration: underline; }
+
     /* ── Footer ───────────────────────────────────────────────── */
     footer {
       max-width: 1400px;
@@ -280,8 +398,36 @@ <h1>Known Good Status</h1>
     <strong>Your PAT is not sent anywhere — it is only kept in the local cache of this page.</strong></span>
   </div>
 
-  <div id="filters"></div>
-  <div id="grid"></div>
+  <div id="code-quality-section">
+    <div class="cq-header">
+      <h2>📊 Code Quality</h2>
+      <div class="cq-timestamp" id="cq-timestamp"></div>
+    </div>
+
+    <div class="cq-metrics-grid" id="cq-metrics-grid">
+      <!-- Filled by JS -->
+    </div>
+
+    <div class="cq-rules-section">
+      <div class="cq-rules-header">Top Violated Rules</div>
+      <table class="cq-rules-table" id="cq-rules-table">
+        <thead>
+          <tr>
+            <th>Rule ID</th>
+            <th>Count</th>
+            <th>Severity</th>
+          </tr>
+        </thead>
+        <tbody id="cq-rules-tbody">
+          <!-- Filled by JS -->
+        </tbody>
+      </table>
+    </div>
+
+    <div class="cq-footer">
+      Full CodeQL report available at <a href="codeql-report.html" target="_blank" rel="noopener">codeql-report.html</a>
+    </div>
+  </div>
 
   <footer>
     Commits-behind data fetched live from the GitHub REST API.
@@ -289,6 +435,82 @@ <h1>Known Good Status</h1>
 
   <script>
     const MODULES = {{ modules_json | safe }};
+    const CODEQL_METRICS = {{ codeql_metrics | safe }};
+
+    // ── Code Quality Rendering ────────────────────────────────────────────
+    function renderCodeQuality() {
+      if (!CODEQL_METRICS) return; // No metrics available
+      
+      const section = document.getElementById('code-quality-section');
+      const gridEl = document.getElementById('cq-metrics-grid');
+      const tableBodyEl = document.getElementById('cq-rules-tbody');
+      const timestampEl = document.getElementById('cq-timestamp');
+
+      // Show section
+      section.classList.add('visible');
+
+      // Render timestamp
+      if (CODEQL_METRICS.generated_at) {
+        const dt = new Date(CODEQL_METRICS.generated_at);
+        timestampEl.textContent = `Generated: ${dt.toLocaleString()}`;
+      }
+
+      // Render metrics cards
+      const metrics = CODEQL_METRICS.overall_metrics || {};
+      const severity = CODEQL_METRICS.metrics_by_severity || {};
+
+      // Total findings card
+      gridEl.innerHTML = `
+        <div class="cq-metric-card">
+          <div class="cq-value">${metrics.total_findings || 0}</div>
+          <div class="cq-label">Total Findings</div>
+        </div>
+      `;
+
+      // Severity breakdown cards
+      const severityLevels = ['error', 'warning', 'note'];
+      severityLevels.forEach(level => {
+        if (severity[level]) {
+          const count = severity[level].count || 0;
+          const pct = (severity[level].percentage || 0).toFixed(1);
+          gridEl.innerHTML += `
+            <div class="cq-metric-card ${level}">
+              <div class="cq-value">${count}</div>
+              <div class="cq-label">${level.charAt(0).toUpperCase() + level.slice(1)}</div>
+              <div class="cq-percent">${pct}%</div>
+            </div>
+          `;
+        }
+      });
+
+      // Render top 10 rules
+      const rules = CODEQL_METRICS.metrics_by_rule || {};
+      const sortedRules = Object.entries(rules)
+        .sort((a, b) => (b[1].count || 0) - (a[1].count || 0))
+        .slice(0, 10);
+
+      tableBodyEl.innerHTML = sortedRules.map(([ruleId, data]) => {
+        const severity = data.severity || 'note';
+        const count = data.count || 0;
+        return `
+          <tr>
+            <td class="cq-rule-name">${ruleId}</td>
+            <td class="cq-rule-count">${count}</td>
+            <td>
+              <span class="cq-rule-severity ${severity}">${severity}</span>
+            </td>
+          </tr>
+        `;
+      }).join('');
+
+      if (sortedRules.length === 0) {
+        tableBodyEl.innerHTML = `
+          <tr>
+            <td colspan="3" style="text-align: center; color: var(--muted);">No violations found</td>
+          </tr>
+        `;
+      }
+    }
 
     // ── Token storage ──────────────────────────────────────────────────────
     function getToken()   { return localStorage.getItem('gh_token') || ''; }
@@ -578,6 +800,7 @@ <h1>Known Good Status</h1>
     document.getElementById('refresh-btn').addEventListener('click', () => render(false));
     renderAuthBar();
     render(true);   // use cache on initial page load
+    renderCodeQuality();  // render code quality metrics if available
   </script>
 </body>
 </html>
diff --git a/scripts/tooling/cli/misc/html_report.py b/scripts/tooling/cli/misc/html_report.py
index 00af22e2cf1..028b45ca701 100644
--- a/scripts/tooling/cli/misc/html_report.py
+++ b/scripts/tooling/cli/misc/html_report.py
@@ -97,10 +97,40 @@ def _enrich_with_compare_data(entries: list[dict[str, Any]], token: str) -> None
             _LOG.warning("Could not fetch compare data for %s@%s", entry["owner_repo"], entry["branch"])
 
 
-def generate_report(known_good: KnownGood, token: Optional[str] = None) -> str:
+def load_codeql_metrics(metrics_path: Optional[Path] = None) -> Optional[dict]:
+    """Load CodeQL metrics from codeql-metrics.json if available.
+    
+    Args:
+        metrics_path: Optional path to metrics JSON file. If None, looks in current directory.
+    
+    Returns:
+        Parsed metrics dict or None if file not found.
+    """
+    if metrics_path is None:
+        metrics_path = Path("codeql-metrics.json")
+    else:
+        metrics_path = Path(metrics_path)
+    
+    if metrics_path.exists():
+        try:
+            return json.loads(metrics_path.read_text(encoding="utf-8"))
+        except (json.JSONDecodeError, IOError) as exc:
+            _LOG.warning("Failed to load metrics from %s: %s", metrics_path, exc)
+            return None
+    return None
+
+
+def generate_report(
+    known_good: KnownGood,
+    token: Optional[str] = None,
+    metrics_path: Optional[Path] = None,
+) -> str:
     entries = _collect_entries(known_good)
     if token:
         _enrich_with_compare_data(entries, token)
+    
+    codeql_metrics = load_codeql_metrics(metrics_path)
+    
     env = Environment(
         loader=FileSystemLoader(TEMPLATE_DIR),
         autoescape=select_autoescape(["html"]),
@@ -109,11 +139,20 @@ def generate_report(known_good: KnownGood, token: Optional[str] = None) -> str:
     return tmpl.render(
         modules_json=json.dumps(entries, indent=2),
         timestamp=known_good.timestamp,
+        codeql_metrics=json.dumps(codeql_metrics) if codeql_metrics else None,
     )
 
 
-def write_report(known_good: KnownGood, output_path: Path, token: Optional[str] = None) -> None:
-    Path(output_path).write_text(generate_report(known_good, token), encoding="utf-8")
+def write_report(
+    known_good: KnownGood,
+    output_path: Path,
+    token: Optional[str] = None,
+    metrics_path: Optional[Path] = None,
+) -> None:
+    Path(output_path).write_text(
+        generate_report(known_good, token, metrics_path),
+        encoding="utf-8",
+    )
 
 
 def register(subparsers: argparse._SubParsersAction) -> None:
@@ -130,6 +169,12 @@ def register(subparsers: argparse._SubParsersAction) -> None:
         default="report.html",
         help="Output HTML file path (default: report.html)",
     )
+    parser.add_argument(
+        "--metrics",
+        metavar="FILE",
+        default=None,
+        help="Path to codeql-metrics.json for code quality section (optional)",
+    )
     parser.set_defaults(func=_run)
 
 
@@ -143,9 +188,12 @@ def _run(args: argparse.Namespace) -> int:
 
     token = os.environ.get("GITHUB_TOKEN")
     output = _resolve_path_from_bazel(Path(args.output))
-    write_report(known_good, output, token=token)
+    metrics_path = Path(args.metrics) if args.metrics else None
+    write_report(known_good, output, token=token, metrics_path=metrics_path)
     if token:
         print(f"Report written to {output} (current hashes fetched from GitHub)")
     else:
         print(f"Report written to {output} (set GITHUB_TOKEN to embed current hashes)")
+    if metrics_path and metrics_path.exists():
+        print(f"Code quality metrics loaded from {metrics_path}")
     return 0
diff --git a/scripts/tooling/cli/workflow/__init__.py b/scripts/tooling/cli/workflow/__init__.py
index ca5de742e9c..eb40dab6e93 100644
--- a/scripts/tooling/cli/workflow/__init__.py
+++ b/scripts/tooling/cli/workflow/__init__.py
@@ -10,3 +10,18 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
+import argparse
+
+
+def register(subparsers: argparse._SubParsersAction) -> None:
+    """Register workflow utility commands."""
+    workflow_parser = subparsers.add_parser("workflow", help="Workflow utility commands")
+    workflow_sub = workflow_parser.add_subparsers(dest="command", metavar="COMMAND")
+    workflow_sub.required = True
+
+    from scripts.tooling.cli.workflow.extract_codeql_metrics import (
+        register as _register_extract_codeql_metrics,
+    )
+
+    _register_extract_codeql_metrics(workflow_sub)
+
diff --git a/scripts/tooling/cli/workflow/extract_codeql_metrics.py b/scripts/tooling/cli/workflow/extract_codeql_metrics.py
new file mode 100644
index 00000000000..14adf09251d
--- /dev/null
+++ b/scripts/tooling/cli/workflow/extract_codeql_metrics.py
@@ -0,0 +1,275 @@
+#!/usr/bin/env python3
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+"""
+Extract CodeQL metrics from SARIF results.
+
+Parses recategorized SARIF output from CodeQL analysis and produces a JSON file
+containing aggregated metrics grouped by severity and rule, following the
+codeql-metrics-schema.json specification.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import logging
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Optional
+
+_LOG = logging.getLogger(__name__)
+
+SARIF_FILE = "sarif-results/cpp.sarif"
+OUTPUT_FILE = "codeql-metrics.json"
+SCHEMA_VERSION = "1"
+
+
+def load_sarif_file(sarif_path: Path) -> Optional[dict]:
+    """Load and validate SARIF file exists and is valid JSON."""
+    if not sarif_path.exists():
+        _LOG.warning("SARIF file not found at %s", sarif_path)
+        return None
+
+    try:
+        with open(sarif_path, "r", encoding="utf-8") as f:
+            sarif_data = json.load(f)
+        _LOG.info("Loaded SARIF file: %s", sarif_path)
+        return sarif_data
+    except (json.JSONDecodeError, IOError) as e:
+        _LOG.error("Failed to load SARIF file: %s", e)
+        return None
+
+
+def extract_findings(sarif_data: dict) -> list[dict]:
+    """
+    Extract all findings from SARIF data.
+
+    Returns list of findings with normalized structure:
+    {
+        "ruleId": "cpp/some-rule",
+        "severity": "error|warning|note",
+        "message": "...",
+        "ruleName": "..."
+    }
+    """
+    findings = []
+
+    if "runs" not in sarif_data:
+        _LOG.warning("No runs found in SARIF data")
+        return findings
+
+    for run in sarif_data.get("runs", []):
+        for result in run.get("results", []):
+            # Extract severity (default to 'warning' if not specified)
+            level = result.get("level", "warning")
+            # SARIF level can be: "none", "note", "warning", "error"
+            if level == "none":
+                severity = "note"
+            else:
+                severity = level
+
+            # Extract rule ID
+            rule_ref = result.get("ruleId", "unknown")
+            rule_name = None
+
+            # Try to get rule name from rule object if available
+            if "rule" in result:
+                rule_name = result["rule"].get("id", rule_ref)
+
+            # Try to get from ruleIndex and rules array
+            if not rule_name and "ruleIndex" in result and "rules" in run:
+                rule_idx = result.get("ruleIndex", -1)
+                if 0 <= rule_idx < len(run["rules"]):
+                    rule_name = run["rules"][rule_idx].get("id", rule_ref)
+
+            # Extract message
+            message = "No message"
+            if "message" in result:
+                if isinstance(result["message"], dict):
+                    message = result["message"].get("text", message)
+                else:
+                    message = str(result["message"])
+
+            findings.append(
+                {
+                    "ruleId": rule_ref,
+                    "severity": severity,
+                    "message": message,
+                    "ruleName": rule_name or rule_ref,
+                }
+            )
+
+    _LOG.info("Extracted %d findings from SARIF", len(findings))
+    return findings
+
+
+def build_metrics(findings: list[dict]) -> dict:
+    """
+    Aggregate findings into metrics matching codeql-metrics-schema.json.
+
+    Returns metrics dict with overall_metrics, metrics_by_severity, metrics_by_rule.
+    """
+    severity_counts = {"error": 0, "warning": 0, "note": 0}
+    rule_metrics = {}
+
+    # Aggregate by severity and rule
+    for finding in findings:
+        severity = finding["severity"]
+        rule_id = finding["ruleId"]
+
+        # Count by severity
+        severity_counts[severity] = severity_counts.get(severity, 0) + 1
+
+        # Aggregate by rule
+        if rule_id not in rule_metrics:
+            rule_metrics[rule_id] = {
+                "count": 0,
+                "severity": severity,
+                "rule_name": finding.get("ruleName", rule_id),
+            }
+        rule_metrics[rule_id]["count"] += 1
+
+    total_findings = len(findings)
+
+    # Calculate percentages
+    metrics_by_severity = {}
+    for severity, count in severity_counts.items():
+        percentage = (count / total_findings * 100) if total_findings > 0 else 0
+        metrics_by_severity[severity] = {
+            "count": count,
+            "percentage": round(percentage, 2),
+        }
+
+    # Sort rules by count descending
+    sorted_rules = dict(
+        sorted(rule_metrics.items(), key=lambda x: x[1]["count"], reverse=True)
+    )
+
+    metrics = {
+        "schema_version": SCHEMA_VERSION,
+        "generated_by": "extract_codeql_metrics.py",
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+        "overall_metrics": {
+            "total_findings": total_findings,
+            "errors": severity_counts["error"],
+            "warnings": severity_counts["warning"],
+            "notes": severity_counts["note"],
+        },
+        "metrics_by_severity": metrics_by_severity,
+        "metrics_by_rule": sorted_rules,
+    }
+
+    return metrics
+
+
+def extract_codeql_metrics(
+    sarif_path: Path = Path(SARIF_FILE), output_path: Path = Path(OUTPUT_FILE)
+) -> bool:
+    """
+    Main workflow: load SARIF, extract metrics, write output.
+
+    Returns True on success, False on failure.
+    """
+    sarif_data = load_sarif_file(sarif_path)
+
+    # If SARIF doesn't exist, output empty metrics
+    if sarif_data is None:
+        _LOG.info("Creating empty metrics file (no SARIF available)")
+        empty_metrics = {
+            "schema_version": SCHEMA_VERSION,
+            "generated_by": "extract_codeql_metrics.py",
+            "generated_at": datetime.now(timezone.utc).isoformat(),
+            "overall_metrics": {
+                "total_findings": 0,
+                "errors": 0,
+                "warnings": 0,
+                "notes": 0,
+            },
+            "metrics_by_severity": {
+                "error": {"count": 0, "percentage": 0},
+                "warning": {"count": 0, "percentage": 0},
+                "note": {"count": 0, "percentage": 0},
+            },
+            "metrics_by_rule": {},
+        }
+        output_path.write_text(json.dumps(empty_metrics, indent=2), encoding="utf-8")
+        _LOG.info("Wrote empty metrics to %s", output_path)
+        return True
+
+    try:
+        findings = extract_findings(sarif_data)
+        metrics = build_metrics(findings)
+
+        output_path.parent.mkdir(parents=True, exist_ok=True)
+        output_path.write_text(json.dumps(metrics, indent=2), encoding="utf-8")
+        _LOG.info("Wrote metrics to %s", output_path)
+
+        # Print summary
+        print(f"CodeQL Metrics Summary:")
+        print(f"  Total findings: {metrics['overall_metrics']['total_findings']}")
+        print(f"  Errors: {metrics['overall_metrics']['errors']}")
+        print(f"  Warnings: {metrics['overall_metrics']['warnings']}")
+        print(f"  Notes: {metrics['overall_metrics']['notes']}")
+        print(f"  Unique rules: {len(metrics['metrics_by_rule'])}")
+
+        return True
+
+    except Exception as e:
+        _LOG.error("Failed to extract metrics: %s", e)
+        return False
+
+
+def register(subparsers: argparse._SubParsersAction) -> None:
+    """Register CLI command for extracting CodeQL metrics."""
+    parser = subparsers.add_parser(
+        "extract_codeql_metrics", help="Extract code quality metrics from CodeQL SARIF results"
+    )
+    parser.add_argument(
+        "--sarif",
+        metavar="PATH",
+        default=SARIF_FILE,
+        help=f"Path to SARIF file (default: {SARIF_FILE})",
+    )
+    parser.add_argument(
+        "--output",
+        metavar="FILE",
+        default=OUTPUT_FILE,
+        help=f"Output metrics JSON file (default: {OUTPUT_FILE})",
+    )
+    parser.set_defaults(func=_run)
+
+
+def _run(args: argparse.Namespace) -> int:
+    """CLI entry point."""
+    logging.basicConfig(
+        level=logging.INFO,
+        format="%(levelname)s: %(message)s",
+    )
+
+    success = extract_codeql_metrics(
+        sarif_path=Path(args.sarif),
+        output_path=Path(args.output),
+    )
+    return 0 if success else 1
+
+
+if __name__ == "__main__":
+    # Can be run standalone for testing
+    import sys
+
+    logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
+    success = extract_codeql_metrics()
+    sys.exit(0 if success else 1)
diff --git a/scripts/tooling/cli/workflow/generate_misra_report.py b/scripts/tooling/cli/workflow/generate_misra_report.py
new file mode 100644
index 00000000000..9a05a2be826
--- /dev/null
+++ b/scripts/tooling/cli/workflow/generate_misra_report.py
@@ -0,0 +1,245 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+"""
+Generate MISRA C/C++ compliance reports from CodeQL database results.
+
+Parses CodeQL analysis output and generates structured MISRA violation reports
+for CI/CD integration and dashboard display.
+"""
+
+import argparse
+import json
+import logging
+import sys
+from pathlib import Path
+
+_LOG = logging.getLogger(__name__)
+logging.basicConfig(level=logging.INFO, format="%(message)s")
+
+
+def parse_codeql_results(results_path: Path) -> list[dict]:
+    """
+    Parse CodeQL SARIF or JSON results for MISRA violations.
+
+    Args:
+        results_path: Path to CodeQL results file (.sarif or .json)
+
+    Returns:
+        List of violation dictionaries with rule, location, and message fields
+    """
+    if not results_path.exists():
+        _LOG.error(f"Results file not found: {results_path}")
+        return []
+
+    try:
+        with open(results_path, "r") as f:
+            data = json.load(f)
+    except json.JSONDecodeError as e:
+        _LOG.error(f"Failed to parse JSON from {results_path}: {e}")
+        return []
+
+    violations = []
+
+    # Handle SARIF format
+    if results_path.suffix == ".sarif":
+        for run in data.get("runs", []):
+            tool_name = run.get("tool", {}).get("driver", {}).get("name", "")
+            _LOG.info(f"Parsing CodeQL results from: {tool_name}")
+
+            for result in run.get("results", []):
+                rule_id = result.get("ruleId", "unknown")
+                message = result.get("message", {}).get("text", "")
+
+                # Extract location information
+                locations = result.get("locations", [])
+                if locations:
+                    physical_loc = locations[0].get("physicalLocation", {})
+                    artifact_location = physical_loc.get("artifactLocation", {})
+                    file_path = artifact_location.get("uri", "unknown")
+
+                    region = physical_loc.get("region", {})
+                    line = region.get("startLine", 0)
+                    column = region.get("startColumn", 0)
+
+                    violations.append({
+                        "rule": rule_id,
+                        "file": file_path,
+                        "line": line,
+                        "column": column,
+                        "message": message,
+                        "level": result.get("level", "warning"),
+                    })
+    else:
+        # Handle generic JSON format (CodeQL query results)
+        if isinstance(data, list):
+            for item in data:
+                violations.append({
+                    "rule": item.get("rule", "unknown"),
+                    "file": item.get("file", "unknown"),
+                    "line": item.get("line", 0),
+                    "message": item.get("message", ""),
+                })
+        elif isinstance(data, dict):
+            # Try common CodeQL result structures
+            results = data.get("results", data.get("violations", []))
+            for item in results:
+                violations.append({
+                    "rule": item.get("rule", "unknown"),
+                    "file": item.get("file", "unknown"),
+                    "line": item.get("line", 0),
+                    "message": item.get("message", ""),
+                })
+
+    _LOG.info(f"Found {len(violations)} MISRA violations")
+    return violations
+
+
+def generate_summary_report(violations: list[dict], output_path: Path) -> None:
+    """
+    Generate a summary report grouped by MISRA rule.
+
+    Args:
+        violations: List of violation dictionaries
+        output_path: Path to write the JSON summary report
+    """
+    # Group violations by rule
+    rule_groups = {}
+    for v in violations:
+        rule = v.get("rule", "unknown")
+        if rule not in rule_groups:
+            rule_groups[rule] = {
+                "rule": rule,
+                "count": 0,
+                "violations": [],
+            }
+        rule_groups[rule]["count"] += 1
+        rule_groups[rule]["violations"].append({
+            "file": v.get("file", ""),
+            "line": v.get("line", 0),
+            "message": v.get("message", ""),
+        })
+
+    # Sort by count (most violations first)
+    sorted_rules = sorted(rule_groups.values(), key=lambda x: x["count"], reverse=True)
+
+    report = {
+        "total_violations": len(violations),
+        "unique_rules": len(sorted_rules),
+        "rules": sorted_rules,
+    }
+
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    with open(output_path, "w") as f:
+        json.dump(report, f, indent=2)
+
+    _LOG.info(f"Summary report written to {output_path}")
+
+
+def generate_markdown_report(violations: list[dict], output_path: Path) -> None:
+    """
+    Generate a Markdown report for GitHub/CI display.
+
+    Args:
+        violations: List of violation dictionaries
+        output_path: Path to write the Markdown report
+    """
+    # Group by rule
+    rule_groups = {}
+    for v in violations:
+        rule = v.get("rule", "unknown")
+        if rule not in rule_groups:
+            rule_groups[rule] = []
+        rule_groups[rule].append(v)
+
+    lines = [
+        "# MISRA Compliance Report",
+        "",
+        f"**Total Violations:** {len(violations)}",
+        f"**Unique Rules:** {len(rule_groups)}",
+        "",
+        "## Summary by Rule",
+        "",
+        "| Rule | Count |",
+        "|------|-------|",
+    ]
+
+    for rule, v_list in sorted(rule_groups.items(), key=lambda x: len(x[1]), reverse=True):
+        lines.append(f"| {rule} | {len(v_list)} |")
+
+    lines.extend(["", "## Violations by Rule", ""])
+
+    for rule, v_list in sorted(rule_groups.items()):
+        lines.extend([f"### {rule}", "", f"*{len(v_list)} violation(s)*", ""])
+        for v in v_list:
+            file_path = v.get("file", "")
+            line_num = v.get("line", 0)
+            message = v.get("message", "")
+            lines.append(f"- **{file_path}:{line_num}**: {message}")
+        lines.append("")
+
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    with open(output_path, "w") as f:
+        f.write("\n".join(lines))
+
+    _LOG.info(f"Markdown report written to {output_path}")
+
+
+def main() -> int:
+    """Main entry point for standalone execution."""
+    parser = argparse.ArgumentParser(
+        description="Generate MISRA compliance reports from CodeQL results"
+    )
+    parser.add_argument(
+        "--input", "-i",
+        required=True,
+        help="Path to CodeQL SARIF or JSON results file",
+    )
+    parser.add_argument(
+        "--output-dir", "-o",
+        default="./misra_reports",
+        help="Output directory for generated reports (default: ./misra_reports)",
+    )
+    parser.add_argument(
+        "--format", "-f",
+        choices=["json", "markdown", "all"],
+        default="all",
+        help="Report format to generate (default: all)",
+    )
+
+    args = parser.parse_args()
+
+    results_path = Path(args.input)
+    output_dir = Path(args.output_dir)
+
+    # Parse violations from CodeQL results
+    violations = parse_codeql_results(results_path)
+
+    if not violations:
+        _LOG.warning("No MISRA violations found in input file")
+        return 0
+
+    # Generate requested report formats
+    if args.format in ("json", "all"):
+        summary_path = output_dir / "misra_summary.json"
+        generate_summary_report(violations, summary_path)
+
+    if args.format in ("markdown", "all"):
+        markdown_path = output_dir / "misra_report.md"
+        generate_markdown_report(violations, markdown_path)
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/tooling/requirements.in b/scripts/tooling/requirements.in
index a4ee406fd56..d742c40c454 100644
--- a/scripts/tooling/requirements.in
+++ b/scripts/tooling/requirements.in
@@ -1,3 +1,4 @@
 jinja2 >= 3
+jsonschema>=4.0
 PyGithub>=2.1.1
 GitPython>=3.1.0
diff --git a/scripts/tooling/requirements.txt b/scripts/tooling/requirements.txt
index 90d02660ceb..59fd74465cf 100644
--- a/scripts/tooling/requirements.txt
+++ b/scripts/tooling/requirements.txt
@@ -4,6 +4,9 @@
 #
 #    bazel run //scripts/tooling:requirements.update
 #
+attrs==26.1.0 \
+    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \
+    --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32
 basedpyright==1.35.0 \
     --hash=sha256:2a7e0bd476623d48499e2b18ff6ed19dc28c51909cf9e1152ad355b5809049ad \
     --hash=sha256:4f4f84023df5a0cd4ee154916ba698596682ac98bacfa22c941ed6aaf07bba4e
@@ -274,6 +277,12 @@ iniconfig==2.3.0 \
 jinja2==3.1.6 \
     --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
     --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
+jsonschema==4.26.0 \
+    --hash=sha256:0c26707e2efad8aa1bfc5b7ce170f3fccc2e4918ff85989ba9ffa9facb2be326 \
+    --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce
+jsonschema-specifications==2025.9.1 \
+    --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe \
+    --hash=sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d
 markupsafe==3.0.3 \
     --hash=sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f \
     --hash=sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a \
@@ -386,9 +395,9 @@ pycparser==3.0 \
 pygithub==2.8.1 \
     --hash=sha256:23a0a5bca93baef082e03411bf0ce27204c32be8bfa7abc92fe4a3e132936df0 \
     --hash=sha256:341b7c78521cb07324ff670afd1baa2bf5c286f8d9fd302c1798ba594a5400c9
-pygments==2.19.2 \
-    --hash=sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887 \
-    --hash=sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b
+pygments==2.20.0 \
+    --hash=sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f \
+    --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
 pyjwt[crypto]==2.11.0 \
     --hash=sha256:35f95c1f0fbe5d5ba6e43f00271c275f7a1a4db1dab27bf708073b75318ea623 \
     --hash=sha256:94a6bde30eb5c8e04fee991062b534071fd1439ef58d2adc9ccb823e7bcd0469
@@ -418,12 +427,132 @@ pynacl==1.6.2 \
     --hash=sha256:d071c6a9a4c94d79eb665db4ce5cedc537faf74f2355e4d502591d850d3913c0 \
     --hash=sha256:d29bfe37e20e015a7d8b23cfc8bd6aa7909c92a1b8f41ee416bbb3e79ef182b2 \
     --hash=sha256:fe9847ca47d287af41e82be1dd5e23023d3c31a951da134121ab02e42ac218c9
-pytest==9.0.1 \
-    --hash=sha256:3e9c069ea73583e255c3b21cf46b8d3c56f6e3a1a8f6da94ccb0fcf57b9d73c8 \
-    --hash=sha256:67be0030d194df2dfa7b556f2e56fb3c3315bd5c8822c6951162b92b32ce7dad
+pytest==9.0.3 \
+    --hash=sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9 \
+    --hash=sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c
+referencing==0.37.0 \
+    --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \
+    --hash=sha256:44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8
 requests==2.32.5 \
     --hash=sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6 \
     --hash=sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf
+rpds-py==2026.6.3 \
+    --hash=sha256:0be972be84cfcaf46c8c6edf690ca0f154ac17babf1f6a955a51579b34ad2dc5 \
+    --hash=sha256:127565fead0a10943b282957bd5447804ff3160ad79f2ad2635e6d249e380680 \
+    --hash=sha256:127e08c0642d880cf32ca47ec2a4a77b901f7e2dd1ad9762adb13955d72ffcc9 \
+    --hash=sha256:166cf54d9f44fc6ceb53c7860258dde44a81406646de79f8ed3234fca3b6e538 \
+    --hash=sha256:168c733a7112e071bb7a66460e667edfcff06c017a3c523f7a8a8e08d0140804 \
+    --hash=sha256:1967debc37f64f2c4dc90a7f563aec558b471966e12adcac4e1c4240496b6ebf \
+    --hash=sha256:1cebd1337c242e4ec2293e541f712b2da849b29f48f0c293684b71c0632625d4 \
+    --hash=sha256:1cf01971c4f2c5553b772a542e4aaf191789cd331bc2cd4ff0e6e65ba49e1e97 \
+    --hash=sha256:1e5822dfc2f0d4ab7e745eaa6d85945069329beeccef965af3f3bb26058fcab6 \
+    --hash=sha256:22bffe6042b9bcb0822bcd1955ec00e245daf17b4344e4ed8e9551b976b63e96 \
+    --hash=sha256:23a439f31ccbeff1574e24889128821d1f7917470e830cf6544dced1c662262a \
+    --hash=sha256:24e9c5386e16669b674a69c156c8eeefcb578f3b3397b713b08e6d60f3c7b187 \
+    --hash=sha256:270b293dae9058fc9fcedab50f13cebf46fb8ed1d1d54e0521a9da5d6b211975 \
+    --hash=sha256:29dfa0533a5d4c94d4dfa1b694fcb56c9c63aad8330ffdd816fd225d0a7a162f \
+    --hash=sha256:2a9c6f195058cb45335e8cc3802745c603d716eb96bc9625950c1aac71c0c703 \
+    --hash=sha256:2bfd04c19ddbd6640de0b51894d764bd2758854d5b75bd102d2ef10cb9c293a9 \
+    --hash=sha256:2c54a076ca4d370980ab57bc0e31df57bbe8d41340436a90ef8b1219a3cbb127 \
+    --hash=sha256:2c958bf94822e9290a40aaf2a822d4bc5c88099093e3948ad6c571eca9272e5f \
+    --hash=sha256:2c99f7e8ccb3dd6e3e4bfeac657a7b208c9bac8075f4b078c02d7404c34107fa \
+    --hash=sha256:2f7c26fbc5acd2522b95d4177fe4710ffd8e9b20529e703ffbf8db4d93903f05 \
+    --hash=sha256:30c6dc199b24a5e3e81d50da0f00858c5bbdb2617a750395687f4339c5818171 \
+    --hash=sha256:38a2fea2787428f811719ceb9114cb78964a3138838320c29ac39526c79c16ba \
+    --hash=sha256:3a83ae6c67b7676b9878378547ca8e93ed77a580037bcbcd1d32f739e1e6089c \
+    --hash=sha256:3cfe765c1da0072636ca06628261e0ea05688e160d5c8a03e0217c3854037223 \
+    --hash=sha256:421aba32367055614287a4292b6a17f1939c9452299f7a0209c117e990b646d4 \
+    --hash=sha256:425560c6fa0415f27261727bb20bd097568485e5eb0c121f1949417d1c516885 \
+    --hash=sha256:4470ce197d4090875cf6affbf1f853338387428df97c4fb7b7106317b8214698 \
+    --hash=sha256:4cf2d36a2357e4d07bb5a4f98801265327b48256867816cfd2ceb001e9754a8f \
+    --hash=sha256:4f4bca01b63096f606e095734dd56e74e175f94cfbf24ff3d63281cec61f7bb7 \
+    --hash=sha256:501f9f04a588d6a09179368c57071301445191767c64e4b52a6aa9871f1ef5ed \
+    --hash=sha256:536bceea4fa4acf7e1c61da2b5786304367c816c8895be71b8f537c480b0ea1f \
+    --hash=sha256:538949e262e46caa31ac01bdb3c1e8f642622922cacbabbae6a8445d9dc33eaf \
+    --hash=sha256:539d75de9e0d536c84ff18dfeb805398e58227001ce09231a26a08b9aed1ee0e \
+    --hash=sha256:54f45a148e28767bf343d33a684693c70e451c6f4c0e9904709a723fafbdfc1f \
+    --hash=sha256:55927d532399c2c646100ff7feb48eaa940ad70f42cd68e1328f3ded9f81ca24 \
+    --hash=sha256:58eadac9cd119677b60e1cf8ac4052f35949d71b8a9e5556efccbe82533cf22a \
+    --hash=sha256:5e8d07bddee435a2ff6f1920e18feff28d0bc4533e42f4bf6927fbd073312c41 \
+    --hash=sha256:62698275682bf121181861295c9181e789030a2d516071f5b8f3c23c170cd0fc \
+    --hash=sha256:639c8929aa0afe81be836b04de888460d6bed38b9c54cfc18da8f6bfabf5af5d \
+    --hash=sha256:67e3a721ffc5d8d2210d3671872298c4a84e4b8035cfe42ffd7cde35d772b146 \
+    --hash=sha256:6de4744d05bd1aa1be4ed7ea1189e3979196808008113bbbf899a460966b925e \
+    --hash=sha256:6e84adbcf4bf841aed8116a8264b9f50b4cb3e7bd89b516122e616ac56ca269e \
+    --hash=sha256:7491ee23305ac3eb59e492b6945881f5cd77a6f731061a3f25b77fd40f9e99a4 \
+    --hash=sha256:79486287de1730dbaff3dbd124d0ca4d2ef7f9d29bf2544f1f93c09b5bcbbd12 \
+    --hash=sha256:7b689145a1485c335569bd056464f3243a29af7ed3871c7be31ad624ba239bc7 \
+    --hash=sha256:7f88d653e7b3b779d71ae7454e20dcc9b6bae903f33c269db9f2be41bda3f261 \
+    --hash=sha256:8020133a74bd81b4572dd8e4be028a6b1ebcd70e6726edc3918008c08bee6ee6 \
+    --hash=sha256:808345f53cb952433ca2816f1604ff3515608a81784954f38d4452acfe8e61d5 \
+    --hash=sha256:83e35b57523816c8613fd0776b40cd8bb9f596b37ddd2692eb4a6bb5ab2f8c93 \
+    --hash=sha256:842e7b070435622248c7a2c44ae53fa1440e073cc3023bc919fed570884097a7 \
+    --hash=sha256:847927daf4cffbd4e90e42bc890069897101edd015f956cb8721b3473372edda \
+    --hash=sha256:882076c00c0a608b131187055ddc5ae29f2e7eaf870d6168980420d58528a5c8 \
+    --hash=sha256:8b95977e7211527ab0ba576e286d023389fbeeb32a6b7b771665d333c60e5342 \
+    --hash=sha256:8bb68f03f395eb793220b45c097bd4d8c32944393da0fad8b999efac0868fc8c \
+    --hash=sha256:8c2642a7603ec0b16ed77da4555db3b4b472341904873788327c0b0d7b95f1bb \
+    --hash=sha256:8c3d1e9c15b9d51ca0391e13da1a25a0a4df3c58a37c9dc368e0736cf7f69df0 \
+    --hash=sha256:8c6e5a2f750cc71c3e3b11d71661f21d6f9bc6cebc6564b1466417a1ec03ec77 \
+    --hash=sha256:8d2294a31386bfa251d8c8a39472beee17db67d4f1a6eabea665d35c9a4461c3 \
+    --hash=sha256:8e4320744c1ffdd95a603def63344bfab2d33edeab301c5007e7de9f9f5b3885 \
+    --hash=sha256:8e65860d238379ed982fd9ba690579b5e95af2f4840f99c772816dbe573cb826 \
+    --hash=sha256:8f2e5c5ee828d42cb11760761c0af6507927bec42d0ad5458f97c9203b054617 \
+    --hash=sha256:900a67df3fd1660b035a4761c4ce73c382ea6b35f90f9863c36c6fd8bf8b09bb \
+    --hash=sha256:913ca42ccad3f8cc6e292b587ae8ae49c8c823e5dce51a736252fc7c7cdfa577 \
+    --hash=sha256:9250a9a0a6fd4648b3f868da8d91a4c52b5811a62df58e753d50ae4454a36f80 \
+    --hash=sha256:931908d9fc855d8f74783377822be318edb6dcb19e47169dc038f9a1bf60b06e \
+    --hash=sha256:9826217f048f620d9a712672818bf231442c1b35d96b227a07eabd11b4bb6945 \
+    --hash=sha256:9891e594296ab9dada6551c8e7b387b2721f27a67eecd528412e8906247a7b90 \
+    --hash=sha256:9c1255b302953c86a486b81d330d5ee1d5bd937691ce271b6be0ef0e299eaab7 \
+    --hash=sha256:a0811d33247c3d6128a3001d763f2aa056bb3425204335400ac54f89eec3a0d0 \
+    --hash=sha256:a136d453475ac0fcbda502ef1e6504bd28d6d904700915d278deeab0d00fe140 \
+    --hash=sha256:a214c993455f99a89aaeadc9b21241900037adc9d97203e374d75513c5911822 \
+    --hash=sha256:a3086b538543802f84c843911242db20447de00d8752dd0efc936dbcf02218ba \
+    --hash=sha256:a3450b693fde92133e9f51060568a4c31fcca76d5e53bbd611e689ca446517e9 \
+    --hash=sha256:a550fb4950a06dde3beb4721f5ad4b25bf4513784665b0a8522c792e2bd822a4 \
+    --hash=sha256:a9f4645593036b81bbdb36b9c8e0ea0d1c3fee968c4d59db0344c14087ef143a \
+    --hash=sha256:aca6c1ef08a82bfe327cc156da694660f599923e2e6665b6d81c9c2d0ac9ffc8 \
+    --hash=sha256:acac386b453c2516111b50985d60ce46e7fadb5ea71ae7b25f4c946935bf27cf \
+    --hash=sha256:acc992ab27b15f852c76755eb2ab7dce86585ddadba6fa5946e58556088845b4 \
+    --hash=sha256:ae3d4fe8c0b9213624fdce7279d70e3b148b682ca20719ebd193a23ebfa47324 \
+    --hash=sha256:ae50181a047c871561212bb97f7932a2d45fb53e947bd9b57ebad85b529cbc53 \
+    --hash=sha256:ae6dd8f10bd17aad820876d24caec9efdafd80a318d16c0a48edb5e136902c6b \
+    --hash=sha256:af05d726809bff6b141be124d4c7ce998f9c9c7f30edb1f46c07aa103d540b41 \
+    --hash=sha256:afd70d95892096cdb26f15a00c45907b17817577aa8d1c76b2dcc2788391f9e9 \
+    --hash=sha256:b5c2dc92304aa48a4a60443b548bb12f12e119d4b72f314015e67b9e1be97fca \
+    --hash=sha256:bc0011654b91cc4fb2ae701bec0a0ba1e552c0714247fa7af6c59e0ccfa3a4e1 \
+    --hash=sha256:bcfbcf66006befb9fd2aeaa9e01feaf881b4dc330a02ba07d2322b1c11be7b5d \
+    --hash=sha256:bdbd97738551fca3917c1bd7188bec1920bb520104f28e7e1007f9ceb17b7690 \
+    --hash=sha256:c60924535c75f1566b6eb75b5c31a48a43fef04fa2d0d201acbad8a9969c6107 \
+    --hash=sha256:c7b9a2f8f4d8e90af72571d3d495deebdd7e3c75451f5b41719aee166e940fc2 \
+    --hash=sha256:ca6546b66be9dc4738b1b043d5ebd5488c66c578c5ff0fd0e8065313fe3afb76 \
+    --hash=sha256:ccffae9a092a00deb7efd545fe5e2c33c33b88e7c054337e9a74c179347d0b7d \
+    --hash=sha256:cdc7e35386f3847df728fbcb5e887e2d79c19e2fa1eba9e51b6621d23e3243af \
+    --hash=sha256:d15fde0e6fb0d88a60d221204873743e5d9f0b7d29165e62cd86d0413ad74ba6 \
+    --hash=sha256:d34c20167764fbcf927194d532dd7e0c56772f0a5f943fa5ef9e9afbba8fb9db \
+    --hash=sha256:d483fe17f01ad64b7bf7cc38fcefff1ca9fb83f8c2b2542b68f97ffe0611b369 \
+    --hash=sha256:d7469697dce35be237db177d42e2a2ee26e6dcc5fc052078a6fefabd288c6edd \
+    --hash=sha256:db08f45aecde626498fb3df07bcf6d2ec040af42e859a4f5040d79c200342911 \
+    --hash=sha256:dc319e5a1de4b6913aac94bf6a2f9e847371e0a140a43dd4991db1a09bc2d504 \
+    --hash=sha256:de3eceba0b683bcbb1ab93da016d0270df1f9ae7be716b40214c5dafac6ea45a \
+    --hash=sha256:dfcc8b909769d19db55c7cc9541eb64b9b774b1057ffffb4f1048070475bb9f9 \
+    --hash=sha256:e059c5dde6452b44424bd1834557556c226b57781dee1227af23518459722b13 \
+    --hash=sha256:e4316bf32babbed84e691e352faf967ce2f0f024174a8643c37c94a1080374fc \
+    --hash=sha256:e52655eaf81e32593abedaa4bfe33170c8cfedf3365ed9be6e11e07f148f0278 \
+    --hash=sha256:e55d236be29255554da47abe5c577637db7c24a02b8b46f0ca9524c855801868 \
+    --hash=sha256:ea7bb13b7c9a29791f87a0387ba7d3ad3a6d783d827e4d3f27b40a0ff44495e2 \
+    --hash=sha256:ea964164cc9afa72d4d9b23cc28dafae93693c0a53e0b42acbff15b22c3f9ddd \
+    --hash=sha256:ec829541c45bca16e61c7ae50c20501f213605beb75d1aba91a6ee37fbbb56a4 \
+    --hash=sha256:ecabd69db66de867690f9797f2f8fa27ba501bbc24540cbdbdc649cd15888ba6 \
+    --hash=sha256:ed0c1e5d10cdc7135537988c74a0188da68e2f3c30813ba3744ab1e42e0480f9 \
+    --hash=sha256:f0840b5b17057f7fd918b76183a4b5a0635f43e14eb2ce60dce1d4ee4707ea00 \
+    --hash=sha256:f4d78253f6996be4901669ad25319f842f740eccf4d58e3c7f3dd39e6dde1d8f \
+    --hash=sha256:f56f1695bc5c0871cbc33dc0130fcf503aab0c57dcc5a6700a4f49eba4f2652e \
+    --hash=sha256:f826877d462181e5eb1c26a0026b8d0cab05d99844ecb6d8bf3627a2ca0c0442 \
+    --hash=sha256:f8f23ead891a3b762f35ab3b04623da7056545b48aa60d59957e6789914545da \
+    --hash=sha256:f90938e92afda60266da758ee7d363447f7f0138c9559f9e1811629580582d90 \
+    --hash=sha256:faa679d19a6696fd54259ad321251ad77a13e70e03dd834daa762a44fb6196ef
 smmap==5.0.3 \
     --hash=sha256:4d9debb8b99007ae47165abc08670bd74cb74b5227dda7f643eccc4e9eb5642c \
     --hash=sha256:c106e05d5a61449cf6ba9a1e650227ecfb141590d2a98412103ff35d89fc7b2f
diff --git a/scripts/tooling/tests/test_extract_codeql_metrics.py b/scripts/tooling/tests/test_extract_codeql_metrics.py
new file mode 100644
index 00000000000..201240512c8
--- /dev/null
+++ b/scripts/tooling/tests/test_extract_codeql_metrics.py
@@ -0,0 +1,279 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+import json
+from pathlib import Path
+
+import jsonschema
+import pytest
+
+from cli.workflow.extract_codeql_metrics import (
+    SCHEMA_VERSION,
+    build_metrics,
+    extract_codeql_metrics,
+    extract_findings,
+    load_sarif_file,
+)
+
+
+# Path to the schema relative to the repo root (two levels up from tests/)
+_SCHEMA_PATH = Path(__file__).parents[3] / "docs/schemas/codeql-metrics-schema.json"
+
+
+@pytest.fixture(scope="session")
+def codeql_schema() -> dict:
+    return json.loads(_SCHEMA_PATH.read_text(encoding="utf-8"))
+
+
+# ---------------------------------------------------------------------------
+# Helpers / fixtures
+# ---------------------------------------------------------------------------
+
+MINIMAL_SARIF = {
+    "runs": [
+        {
+            "results": [
+                {
+                    "ruleId": "cpp/use-after-free",
+                    "level": "error",
+                    "message": {"text": "Use after free detected"},
+                },
+                {
+                    "ruleId": "cpp/misleading-indentation",
+                    "level": "warning",
+                    "message": {"text": "Misleading indentation"},
+                },
+                {
+                    "ruleId": "cpp/misleading-indentation",
+                    "level": "warning",
+                    "message": {"text": "Misleading indentation again"},
+                },
+                {
+                    "ruleId": "cpp/info-note",
+                    "level": "none",
+                    "message": {"text": "Informational note"},
+                },
+            ]
+        }
+    ]
+}
+
+
+@pytest.fixture
+def sarif_file(tmp_path: Path) -> Path:
+    p = tmp_path / "cpp.sarif"
+    p.write_text(json.dumps(MINIMAL_SARIF), encoding="utf-8")
+    return p
+
+
+@pytest.fixture
+def output_file(tmp_path: Path) -> Path:
+    return tmp_path / "codeql-metrics.json"
+
+
+# ---------------------------------------------------------------------------
+# load_sarif_file
+# ---------------------------------------------------------------------------
+
+
+class TestLoadSarifFile:
+    def test_returns_none_for_missing_file(self, tmp_path):
+        assert load_sarif_file(tmp_path / "nonexistent.sarif") is None
+
+    def test_loads_valid_sarif(self, sarif_file):
+        data = load_sarif_file(sarif_file)
+        assert data is not None
+        assert "runs" in data
+
+    def test_returns_none_for_invalid_json(self, tmp_path):
+        bad = tmp_path / "bad.sarif"
+        bad.write_text("{ not valid json }", encoding="utf-8")
+        assert load_sarif_file(bad) is None
+
+
+# ---------------------------------------------------------------------------
+# extract_findings
+# ---------------------------------------------------------------------------
+
+
+class TestExtractFindings:
+    def test_empty_sarif_returns_empty_list(self):
+        assert extract_findings({}) == []
+
+    def test_no_results_returns_empty_list(self):
+        assert extract_findings({"runs": [{"results": []}]}) == []
+
+    def test_extracts_count(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        assert len(findings) == 4
+
+    def test_level_none_maps_to_note(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        note_findings = [f for f in findings if f["ruleId"] == "cpp/info-note"]
+        assert note_findings[0]["severity"] == "note"
+
+    def test_error_severity_preserved(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        errors = [f for f in findings if f["severity"] == "error"]
+        assert len(errors) == 1
+        assert errors[0]["ruleId"] == "cpp/use-after-free"
+
+    def test_warning_severity_preserved(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        warnings = [f for f in findings if f["severity"] == "warning"]
+        assert len(warnings) == 2
+
+    def test_default_severity_is_warning(self):
+        # result with no 'level' key
+        sarif = {"runs": [{"results": [{"ruleId": "cpp/foo", "message": {"text": "msg"}}]}]}
+        findings = extract_findings(sarif)
+        assert findings[0]["severity"] == "warning"
+
+    def test_message_extracted_from_dict(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        assert findings[0]["message"] == "Use after free detected"
+
+    def test_rule_id_in_findings(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        rule_ids = {f["ruleId"] for f in findings}
+        assert "cpp/use-after-free" in rule_ids
+        assert "cpp/misleading-indentation" in rule_ids
+
+    def test_multiple_runs(self):
+        sarif = {
+            "runs": [
+                {"results": [{"ruleId": "cpp/a", "level": "error", "message": {"text": "a"}}]},
+                {"results": [{"ruleId": "cpp/b", "level": "warning", "message": {"text": "b"}}]},
+            ]
+        }
+        assert len(extract_findings(sarif)) == 2
+
+
+# ---------------------------------------------------------------------------
+# build_metrics
+# ---------------------------------------------------------------------------
+
+
+class TestBuildMetrics:
+    def test_empty_findings_produces_zero_counts(self):
+        metrics = build_metrics([])
+        assert metrics["overall_metrics"]["total_findings"] == 0
+        assert metrics["overall_metrics"]["errors"] == 0
+        assert metrics["overall_metrics"]["warnings"] == 0
+        assert metrics["overall_metrics"]["notes"] == 0
+
+    def test_empty_findings_zero_percentages(self):
+        metrics = build_metrics([])
+        for sev in ("error", "warning", "note"):
+            assert metrics["metrics_by_severity"][sev]["percentage"] == 0
+
+    def test_total_findings_count(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        metrics = build_metrics(findings)
+        assert metrics["overall_metrics"]["total_findings"] == 4
+
+    def test_severity_counts(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        metrics = build_metrics(findings)
+        assert metrics["overall_metrics"]["errors"] == 1
+        assert metrics["overall_metrics"]["warnings"] == 2
+        assert metrics["overall_metrics"]["notes"] == 1
+
+    def test_percentages_sum_to_100(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        metrics = build_metrics(findings)
+        total_pct = sum(
+            v["percentage"] for v in metrics["metrics_by_severity"].values()
+        )
+        assert abs(total_pct - 100.0) < 0.1
+
+    def test_rule_aggregation(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        metrics = build_metrics(findings)
+        assert metrics["metrics_by_rule"]["cpp/misleading-indentation"]["count"] == 2
+        assert metrics["metrics_by_rule"]["cpp/use-after-free"]["count"] == 1
+
+    def test_rules_sorted_by_count_descending(self):
+        findings = extract_findings(MINIMAL_SARIF)
+        metrics = build_metrics(findings)
+        counts = [v["count"] for v in metrics["metrics_by_rule"].values()]
+        assert counts == sorted(counts, reverse=True)
+
+    def test_schema_version_present(self):
+        metrics = build_metrics([])
+        assert metrics["schema_version"] == SCHEMA_VERSION
+
+    def test_generated_at_present(self):
+        metrics = build_metrics([])
+        assert "generated_at" in metrics
+        assert metrics["generated_at"]  # non-empty string
+
+
+# ---------------------------------------------------------------------------
+# extract_codeql_metrics (integration)
+# ---------------------------------------------------------------------------
+
+
+class TestExtractCodeqlMetrics:
+    def test_returns_true_on_success(self, sarif_file, output_file):
+        assert extract_codeql_metrics(sarif_file, output_file) is True
+
+    def test_writes_output_file(self, sarif_file, output_file):
+        extract_codeql_metrics(sarif_file, output_file)
+        assert output_file.exists()
+
+    def test_output_is_valid_json(self, sarif_file, output_file):
+        extract_codeql_metrics(sarif_file, output_file)
+        data = json.loads(output_file.read_text(encoding="utf-8"))
+        assert "overall_metrics" in data
+
+    def test_creates_empty_metrics_when_sarif_missing(self, tmp_path, output_file):
+        result = extract_codeql_metrics(tmp_path / "missing.sarif", output_file)
+        assert result is True
+        data = json.loads(output_file.read_text(encoding="utf-8"))
+        assert data["overall_metrics"]["total_findings"] == 0
+
+    def test_empty_metrics_output_file_created(self, tmp_path, output_file):
+        extract_codeql_metrics(tmp_path / "missing.sarif", output_file)
+        assert output_file.exists()
+
+    def test_creates_parent_directories(self, sarif_file, tmp_path):
+        nested_output = tmp_path / "a" / "b" / "metrics.json"
+        result = extract_codeql_metrics(sarif_file, nested_output)
+        assert result is True
+        assert nested_output.exists()
+
+
+# ---------------------------------------------------------------------------
+# Schema validation
+# ---------------------------------------------------------------------------
+
+
+class TestSchemaValidation:
+    def test_build_metrics_with_findings_is_valid(self, codeql_schema):
+        findings = extract_findings(MINIMAL_SARIF)
+        metrics = build_metrics(findings)
+        jsonschema.validate(instance=metrics, schema=codeql_schema)
+
+    def test_build_metrics_empty_findings_is_valid(self, codeql_schema):
+        metrics = build_metrics([])
+        jsonschema.validate(instance=metrics, schema=codeql_schema)
+
+    def test_extract_codeql_metrics_output_is_valid(self, sarif_file, output_file, codeql_schema):
+        extract_codeql_metrics(sarif_file, output_file)
+        data = json.loads(output_file.read_text(encoding="utf-8"))
+        jsonschema.validate(instance=data, schema=codeql_schema)
+
+    def test_empty_metrics_output_is_valid(self, tmp_path, output_file, codeql_schema):
+        extract_codeql_metrics(tmp_path / "missing.sarif", output_file)
+        data = json.loads(output_file.read_text(encoding="utf-8"))
+        jsonschema.validate(instance=data, schema=codeql_schema)