Employ CodeQL checks for PR workflow

[ruspl-afed]

Fixes #2357

[github-actions]

Test Results

  110 files  ±0    110 suites  ±0   1m 10s ⏱️ ±0s
6 128 tests ±0  6 128 ✅ ±0  0 💤 ±0  0 ❌ ±0 
6 129 runs  ±0  6 129 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 8e074d6. ± Comparison against base commit b629a2f.

♻️ This comment has been updated with latest results.

[ruspl-afed]

Oh, we have configuration issue again

Error: Code Scanning could not process the submitted SARIF file:
CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled

They say we need to fix this issue with repo settings, but I'm not sure how to do this better https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/default-setup-enabled

@mx990 WDYT?

[mx990]

I checked the default configuration and it claims to already run on push and pull requests to develop and protected branches, but it does not seem to be running for PRs from other repositories¹. I also saw no way to further configure that with the default configuration.

I guess we just have to switch over to the advanced configuration in the settings. In order to keep the downtime short, we should probably wait right before merging this PR and then switch over.

@azoitl WDYT?

Footnotes

1. https://github.com/eclipse-4diac/4diac-ide/actions/workflows/github-code-scanning/codeql ↩

[mx990]

I had a look at codeQLworkflow.yml and it seems to be running a full Maven build ahead of the scanning. So we might want to just run it as part of the regular .github/workflows/maven.yml workflow to save on build time?

[azoitl]

I also find it strange that we pull in a workflow from another repo. This somehow feels not right. I the end it is to get to more actions into our default maven workflow. Therefore I would opt in integrating the codeql steps into our existing maven workflow.

[azoitl]

I guess we just have to switch over to the advanced configuration in the settings. In order to keep the downtime short, we should probably wait right before merging this PR and then switch over.

What advanced settings you mean?

[mx990]

I guess we just have to switch over to the advanced configuration in the settings. In order to keep the downtime short, we should probably wait right before merging this PR and then switch over.

What advanced settings you mean?

I meant the advanced setup for CodeQL, see also Configuring advanced setup for code scanning.