Add CodeQL Security Scan

[KKelvinLo]

Motivation

This PR is a follow-up to issue open-telemetry/oteps#144

CodeQL is GitHub's static analysis engine which scans repos for security vulnerabilities. As the project grows and we near GA it might be useful to have a workflow which checks for security vulnerabilities to ensure that every incremental change is following best development practices. Also passing basic security checks will also make sure that there aren't any glaring issues for our users.

Changes

• This PR adds CodeQL security checks to the repository
• After every run the workflow will upload the results to GitHub.

Workflow Triggers

• daily cron job at 1:30 am
• workflow_dispatch (in the case that the maintainers want to trigger a manual security check)

• CHANGELOG.md updated for non-trivial changes
• [] Unit tests have been added
• [] Changes in public API reviewed

[codecov]

Codecov Report

Merging #770 (49b9d18) into main (af9cd15) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #770   +/-   ##
=======================================
  Coverage   95.95%   95.95%           
=======================================
  Files         176      176           
  Lines        7172     7172           
=======================================
  Hits         6882     6882           
  Misses        290      290           

[maxgolov]

@KKelvinLo - could you please take a look why the check hasn't been showing in the list of successful checks? You may want to adjust the template a bit for the results to show under the Security tab, maybe naming the step as CodeQL.

Template that's been missing the setup parts:
https://github.com/open-telemetry/opentelemetry-cpp/pull/654/files

[maxgolov]

Maybe it's all good already. Perhaps it'd show the results after merge?... 🤷

[lalitb]

Thank you for adding this. Will the CodeQL workflow fails if there are any security vulnerabilities, or it just uploads the result somewhere and we need to periodically keep checking it?

[maxgolov]

Suggested change

	name: "CodeQL Code Scan"
	name: "CodeQL"

That should show the code scan result under Security tab?

[KKelvinLo]

Yep it if is enabled in the security tab, the action will post to the alerts

[maxgolov]

Do we need to click on that in the Security tab or do we need to rename it to CodeQL ?

[KKelvinLo]

Thank you for adding this. Will the CodeQL workflow fails if there are any security vulnerabilities, or it just uploads the result somewhere and we need to periodically keep checking it?

This workflow will post the results under the security tab, the workflow will pass

[KKelvinLo]

@KKelvinLo - could you please take a look why the check hasn't been showing in the list of successful checks? You may want to adjust the template a bit for the results to show under the Security tab, maybe naming the step as CodeQL.

Template that's been missing the setup parts:
https://github.com/open-telemetry/opentelemetry-cpp/pull/654/files

It should be good now - changed it from a cron schedule to on pull request and on push

[maxgolov]

Code scanning results / CodeQL Timed out after 109m

It got crashed on recursive submodules?! 😀

I guess we need to exclude third_party directory.

[alolita]

😀 @KKelvinLo can you please exclude the third-party directories. Let's make sure the workflow is robust. Thanks!

Thanks @maxgolov @ThomsonTan @lalitb for reviewing and merging!

[KKelvinLo]

Code scanning results / CodeQL Timed out after 109m

It got crashed on recursive submodules?! 😀

I guess we need to exclude third_party directory.

After digging through GitHub Actions documentation it doesn't look like there's an explicit exclude directory option, so I added a bash command to remove the third_party directory after checking out the code.

[lalitb]

Code scanning results / CodeQL Timed out after 109m

It got crashed on recursive submodules?! 😀
I guess we need to exclude third_party directory.

After digging through GitHub Actions documentation it doesn't look like there's an explicit exclude directory option, so I added a bash command to remove the third_party directory after checking out the code.

Thanks. Instead of removing the third-party folder later, we can also checkout the repo without submodules :). For now, can you rebase the branch with main, as that will allow us to merge the PR

[KKelvinLo]

Rebased!