chore: add CodeQL code analysis

[stijnmoreels]

Add default CodeQL code analysis file.

Relates to arcus-azure/arcus#195

[netlify]

✔️ Deploy Preview for arcus-observability canceled.

🔨 Explore the source changes: 06b5fac

🔍 Inspect the deploy log: https://app.netlify.com/sites/arcus-observability/deploys/623030ac3790bc00083e3c00

[fgheysels]

Yes, let's do this.
I'm curious to see how the results of this code analysis are presented.

I do see that this task is executed, but can we somehow easily see the results ?

[stijnmoreels]

Yes, let's do this. I'm curious to see how the results of this code analysis are presented.

I do see that this task is executed, but can we somehow easily see the results ?

When clicking on details in the 'Code scanning results` check.
https://github.com/arcus-azure/arcus.observability/pull/350/checks?check_run_id=5549335753

It would maybe be nice to have it presented as a comment in the PR, but then again, it would mean a lot of clutter every time you commit to a PR and would be notified about it. When the scanning fails, it would stop the build, and I think that's enough trigger to look what's wrong. 👍

[fgheysels]

Yes, let's do this. I'm curious to see how the results of this code analysis are presented.
I do see that this task is executed, but can we somehow easily see the results ?

When clicking on details in the 'Code scanning results` check. https://github.com/arcus-azure/arcus.observability/pull/350/checks?check_run_id=5549335753

It would maybe be nice to have it presented as a comment in the PR, but then again, it would mean a lot of clutter every time you commit to a PR and would be notified about it. When the scanning fails, it would stop the build, and I think that's enough trigger to look what's wrong. 👍

True. I wonder though if there's an overview of the things that are being checked.

[stijnmoreels]

True. I wonder though if there's an overview of the things that are being checked.

Yeah, I saw the CodeQL database rules in the build logs: https://github.com/arcus-azure/arcus.observability/runs/5549282791?check_suite_focus=true Maybe there's an official list too somewhere.