Need for a Viable Security Scanning Tool

[kxyr]

A security workflow does not currently exist as part of the CI/CD or security workflows in the Swift repository. This is to satisfy the requirements as per open-telemetry/opentelemetry-specification#1333.

CodeQL is the common security scanning tool that is used currently for all of the supported OpenTelemetry language repositories (Go, Java, Javascript, Python, C++, etc.). Since CodeQL does not offer support for Swift, an alternative needs to be found. The security tool found should be able to integrate with Github Actions.

We evaluated different possibilities, but there seems to be no available code scanning tools for Swift that could be integrated with Github Actions. We’d like to better understand the opinions from Swift engineers on a recommended code scanning tool so that one may be added for open-telemetry/oteps#144.

cc @KKelvinLo @alolita