Add CodeQL analysis workflow configuration

[notdodo]

No description provided.

[github-actions]

KICS version: v2.1.14

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 2 INFO 0 TRACE 0 TOTAL 2	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 4 Queries failed to execute 0 Execution time 0

Queries Results

Query Name Query Id Severity Platform Cwe Cloud Provider Category Experimental Description File Name Line Issue Type Search Key Expected Value Actual Value Unpinned Actions Full Length Commit SHA 555ab8f9-2001-455e-a077-f2d0f41e2fb9 LOW CICD 829 COMMON Supply-Chain false Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork. .github/workflows/codeql.yml 101 IncorrectValue uses={{github/codeql-action/analyze@v4}} Action pinned to a full length commit SHA. Action is not pinned to a full length commit SHA. Unpinned Actions Full Length Commit SHA 555ab8f9-2001-455e-a077-f2d0f41e2fb9 LOW CICD 829 COMMON Supply-Chain false Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork. .github/workflows/codeql.yml 72 IncorrectValue uses={{github/codeql-action/init@v4}} Action pinned to a full length commit SHA. Action is not pinned to a full length commit SHA.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.