diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 000000000..3b55c022a
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,63 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+#  schedule:
+#    - cron: '0 7 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Override automatic language detection by changing the below list
+        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+        language: ['cpp', 'python']
+        # Learn more...
+        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: ${{ matrix.language }}
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    #- name: Autobuild
+    #  uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    - run: |
+       mkdir build && cd build
+       cmake .. -DCMAKE_BUILD_TYPE=Release -DFIZZY_TESTING=ON -DFIZZY_WASI=ON
+       cmake --build .
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1
diff --git a/lib/fizzy/execute.cpp b/lib/fizzy/execute.cpp
index ef7d7d61e..add758651 100644
--- a/lib/fizzy/execute.cpp
+++ b/lib/fizzy/execute.cpp
@@ -459,7 +459,7 @@ T fnearest(T value) noexcept
 }
 
 template <typename T>
-__attribute__((no_sanitize("float-divide-by-zero"))) inline constexpr T fdiv(T a, T b) noexcept
+[[gnu::no_sanitize("float-divide-by-zero")]] inline constexpr T fdiv(T a, T b) noexcept
 {
     static_assert(std::is_floating_point_v<T>);
     static_assert(std::numeric_limits<T>::is_iec559);
@@ -495,8 +495,7 @@ inline T fmax(T a, T b) noexcept
 }
 
 
-__attribute__((no_sanitize("float-cast-overflow"))) inline constexpr float demote(
-    double value) noexcept
+[[gnu::no_sanitize("float-cast-overflow")]] inline constexpr float demote(double value) noexcept
 {
     // The float-cast-overflow UBSan check disabled for this conversion. In older clang versions
     // (up to 8.0) it reports a failure when non-infinity f64 value is converted to f32 infinity.
diff --git a/lib/fizzy/types.hpp b/lib/fizzy/types.hpp
index 7f4272159..9079ff206 100644
--- a/lib/fizzy/types.hpp
+++ b/lib/fizzy/types.hpp
@@ -324,12 +324,34 @@ enum class ExternalKind : uint8_t
 // https://webassembly.github.io/spec/core/binary/modules.html#import-section
 struct Import
 {
+    Import() = default;
+    Import(const Import& other) : module(other.module), name(other.name), kind(other.kind)
+    {
+        switch (other.kind)
+        {
+        case ExternalKind::Function:
+            desc.function_type_index = other.desc.function_type_index;
+            break;
+        case ExternalKind::Table:
+            desc.table = other.desc.table;
+            break;
+        case ExternalKind::Memory:
+            desc.memory = other.desc.memory;
+            break;
+        case ExternalKind::Global:
+            desc.global = other.desc.global;
+            break;
+        }
+    }
+    // TODO needs move constructor
+
     std::string module;
     std::string name;
     ExternalKind kind = ExternalKind::Function;
-    union
+    union Desc
     {
-        TypeIdx function_type_index = 0;
+        Desc() : function_type_index(0) {}
+        TypeIdx function_type_index;
         Memory memory;
         GlobalType global;
         Table table;