Enable code scanning on security purposes:
Is your feature request related to a problem? Please describe.
Our current repository lacks a robust security scanning tool integrated into our CI/CD pipeline. This leads to potential vulnerabilities being overlooked until later stages of development or after deployment, increasing the risk of security breaches and technical debt. A streamlined solution for continuous code scanning and vulnerability detection is needed.
Describe the solution you'd like
Integrate CodeQL Analysis into the GitHub repository for automated security scanning. CodeQL should:
- Analyze code for vulnerabilities across supported languages (C, C++, Python, JavaScript, etc.).
- Run scans automatically on new commits and pull requests.
- Generate detailed reports highlighting security risks and offering actionable remediation steps.
- Integrate results directly into GitHub's Security tab for easy visibility and tracking.
This integration will ensure continuous monitoring and improve overall code security and quality.
Describe alternatives you've considered
- Manual Code Reviews: Time-intensive and prone to human error, making it an unreliable substitute for automated tools.
- Third-party Tools (e.g., SonarQube, Snyk): These provide similar features but may involve additional configuration, costs, or lack the seamless integration with GitHub that CodeQL offers.
- Custom Scripts: Writing custom scripts for static code analysis, which is resource-intensive and lacks the depth and support of CodeQL.
Additional context
- CodeQL is free for public repositories and deeply integrated into GitHub, making it an ideal choice for this workflow.
- Example use case: Pull requests are automatically scanned, and developers are alerted to vulnerabilities before merging.
- Relevant documentation for setup: [CodeQL GitHub Documentation](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors).
Please prioritize this integration to enhance the security and reliability of our codebase.