Adding Security Workflows to GitHub Actions (1/2): codeql workflow

[AzfaarQureshi]

Motivation

Follow up to issue Follow up to issue open-telemetry/oteps#144

CodeQL is GitHub's static analysis engine which scans repos for security vulnerabilities. As the project grows and we near GA it might be useful to have a workflow which checks for security vulnerabilities with every PR so we can ensure every incremental change is following best development practices. Also passing basic security checks will also make sure that there aren't any glaring issues for our users.

Changes

• This PR adds CodeQL security checks to the repo
• After every run the workflow uploads the results to GitHub. Details on the run and security alerts will show up in the security tab of this repo.

Workflow Triggers

• daily cron job at 1:30am
• workflow_dispatch (in case maintainers want to trigger a security check manually)

cc- @alolita

[MrAlias]

@AzfaarQureshi please update with base branch. This looks ready to merge.

[AzfaarQureshi]

@MrAlias rebased!

(copying over question from the go-core PR)

just a quick question, do you want codeql to run on every PR as well or just once daily via the cron job? I just realized that the description is outdated from back when I had the PR trigger as well but I removed it cause I thought it would be too frequent. What are your thoughts?

[MrAlias]

(copying over question from the go-core PR)

just a quick question, do you want codeql to run on every PR as well or just once daily via the cron job? I just realized that the description is outdated from back when I had the PR trigger as well but I removed it cause I thought it would be too frequent. What are your thoughts?

For those following this, I agreed that it was too frequent and the once a night is good.