ci: Add checkov in Github workflow

[dashmug]

Summary by Sourcery

This pull request updates the GitHub Actions workflow to include a new job for checking Terraform code with Checkov. Additionally, minor formatting adjustments were made to the CODE_OF_CONDUCT.md and README.md files.

• CI:
  • Added a new job to the GitHub Actions workflow to check Terraform code using Checkov, including uploading SARIF results.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request updates the GitHub Actions workflow to include a new job for checking Terraform code using Checkov, updates the Python setup action, and makes minor formatting and typographical corrections in the CODE_OF_CONDUCT.md and README.md files.

File-Level Changes

Files	Changes
.github/workflows/ci.yml	Updated Python setup action and added a new job to check Terraform code using Checkov, including SARIF output and upload.
CODE_OF_CONDUCT.md	Standardized list formatting and fixed minor typographical errors.
README.md	Cleaned up unnecessary blank lines for better readability.

---

Tips

• Trigger a new Sourcery review by commenting @sourcery-ai review on the pull request.
• Continue your discussion with Sourcery by replying directly to review comments.
• You can change your review settings at any time by accessing your dashboard:
  • Enable or disable the Sourcery-generated pull request summary or reviewer's guide;
  • Change the review language;
• You can always contact us if you have any questions or feedback.

[sourcery-ai]

Hey @dashmug - I've reviewed your changes and they look great!

Here's what I looked at during the review

• 🟢 General issues: all looks good
• 🟡 Security: 2 issues found
• 🟢 Testing: all looks good
• 🟢 Complexity: all looks good
• 🟡 Documentation: 1 issue found

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment to tell me if it was helpful.}

[sourcery-ai]

🚨 suggestion (security): Consider pinning the Checkov action to a specific version

Using @master for the Checkov action can lead to unexpected issues if breaking changes are introduced in the master branch. Consider pinning to a specific version to ensure stability.

Suggested change

	uses: bridgecrewio/checkov-action@master
	uses: bridgecrewio/checkov-action@2.0.0

[sourcery-ai]

🚨 issue (security): Review the permissions granted to the Checkov job

The Checkov job is granted actions: read, contents: read, and security-events: write permissions. Ensure that these permissions are necessary and follow the principle of least privilege to minimize security risks.

[sourcery-ai]

issue (documentation): Double space detected.

There is a double space between 'behavior,' and 'harassment'. Please correct it to a single space.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud