GitHub Actions: Implement CodeQL

[macho-catt]

Overview

As a developer, we need to ensure that we write secure code and defend against vulnerabilities. To do so, we need to configure code scanning using CodeQL.

Action Items

• Research and investigate how we can use CodeQL
  • Any notes should be documented in this ticket or should be stored on the website team's Google Drive
• We want CodeQL to scan the vulnerabilities for the following:
  • JS code
  • GitHub Actions
  • Liquid
• Create a prototype on your own fork of the repository
• Schedule a time with the dev team and the lead to demo your findings and implementation
• Once approved, write a pull request to implement CodeQL

Resources/Instructions

Code Scanning in GitHub
About CodeQL
Events that trigger workflows
Workflow syntax for GitHub Actions
actions/github-script
GitHub RESTAPI

[github-actions]

Hi @macho-catt.

Good job adding the required labels to this issue.

Additional Resources:
Wiki: How to add status labels to issues (WIP. Link will be updated when the wiki is done)
Wiki: How to create issues (WIP. Link will be updated when the wiki is done)

[SAUMILDHANKAR]

ETA: 5/25/22
Availability: 2 hrs per week