codeql: run static analysis as part of CI builds

CodeQL is GitHub's native offering of a static code analyzer, and hence
integrates with GitHub Actions better than any other static code
analyzer.

By default, it comes with a large range of "queries" that test for
common code patterns that should be avoided.

For now, we only target source code written in C, via the `language:
cpp` directive. Just in case that other languages should be targeted,
too, this GitHub workflow job is set up as a matrix job to make that
easier in the future.

For full documentation, see
https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql

Co-authored-by: Pierre Tempel <turbo@github.com>
Co-authored-by: Arthur Baars <aibaars@github.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Author: 3 people

.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: "CodeQL"
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 3 * * 1' # Every Monday at 03:00 UTC
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["cpp"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Install dependencies
+        run: ci/install-dependencies.sh
+        if: matrix.language == 'cpp'
+        env:
+          jobname: codeql
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+
+      - name: Build
+        if: matrix.language == 'cpp'
+        run: |
+          cat /proc/cpuinfo
+          make -j$(nproc)
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.gitignore

@@ -260,3 +260,5 @@ Release/
 CMakeSettings.json
 /contrib/libgit-rs/target
 /contrib/libgit-sys/target
+/.github/codeql/.cache/
+/.github/codeql/codeql-pack.lock.yml

ci/install-dependencies.sh

@@ -134,7 +134,7 @@ case "$jobname" in
 ClangFormat)
 	sudo apt-get -q -y install clang-format
 	;;
-StaticAnalysis)
+StaticAnalysis|codeql)
 	sudo apt-get -q -y install coccinelle libcurl4-openssl-dev libssl-dev \
 		libexpat-dev gettext make
 	;;