[security] audit repository tooling

[codeboten]

trafficstars

The security SIG is looking to ensure that security tooling is setup consistently across the organization. As a result, we're asking maintainers to ensure the following tools are enabled in each repository:

• [X] CodeQL enabled via GitHub Actions - enabled in opentelemetry-cpp here GitHub Actions
• [ ] Static code analysis tool - missing, see #2297
• [X] Repository security settings
  • [X] Security Policy ✅ - enabled
  • [X] Security advisories ✅ - enabled
  • [X] Private vulnerability reporting ✅ - enabled
  • [X] Dependabot alerts ✅ - enabled
  • [X] Code scanning alerts ✅ - enabled

Parent issue: https://github.com/open-telemetry/sig-security/issues/12

[sakshi-1505]

@codeboten I am an Outreachy candidate, can you please assign me this issue?

[codeboten]

Thanks @sakshi-1505, i don't have the ability to assign issues in this repo. @marcalff are you still working on this issue? would @sakshi-1505 be able to help? Thanks!

[github-actions[bot]]

This issue was marked as stale due to lack of activity.

[sakshi-1505]

Not stale

[github-actions[bot]]

This issue was marked as stale due to lack of activity.